Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
1.exe

Overview

General Information

Sample name:1.exe
Analysis ID:1585170
MD5:3689dace869abbbe4e87f57078f6bec9
SHA1:568f5a26f433d55c2628e3e3a5555a9046b19ee3
SHA256:610f9a21f99667ede85d082521e7b8150b158b80bc1d13c4498ac095b2316255
Tags:exemalwaretrojanuser-Joker
Infos:

Detection

Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Found many strings related to Crypto-Wallets (likely being stolen)
Found pyInstaller with non standard icon
Suspicious powershell command line found
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal communication platform credentials (via file / registry access)
Uses cmd line tools excessively to alter registry or file data
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Uses taskkill to terminate processes

Classification

Process Tree

  • System is w10x64
  • 1.exe (PID: 6392 cmdline: "C:\Users\user\Desktop\1.exe" MD5: 3689DACE869ABBBE4E87F57078F6BEC9)
    • 1.exe (PID: 6008 cmdline: "C:\Users\user\Desktop\1.exe" MD5: 3689DACE869ABBBE4E87F57078F6BEC9)
      • cmd.exe (PID: 3276 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 4568 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • conhost.exe (PID: 4688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 1440 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 6504 cmdline: C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 5064 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • cmd.exe (PID: 6624 cmdline: C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 5840 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName MD5: 227F63E1D9008B36BDBCC4B397780BE4)
      • cmd.exe (PID: 6668 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 6152 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 5660 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 2072 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 5560 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 3620 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 4028 cmdline: C:\Windows\system32\cmd.exe /c "taskkill /f /im exodus.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • taskkill.exe (PID: 1440 cmdline: taskkill /f /im exodus.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
      • powershell.exe (PID: 6160 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 5584 cmdline: powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 4984 cmdline: wmic cpu get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • conhost.exe (PID: 2000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 2300 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • conhost.exe (PID: 1292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 4404 cmdline: wmic computersystem get TotalPhysicalMemory MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • conhost.exe (PID: 6496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 5776 cmdline: C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 7124 cmdline: C:\Windows\System32\wbem\WMIC.exe csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\1.exe", ParentImage: C:\Users\user\Desktop\1.exe, ParentProcessId: 6008, ParentProcessName: 1.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 6668, ProcessName: cmd.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Get-Clipboard, CommandLine: powershell Get-Clipboard, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell Get-Clipboard, ProcessId: 6152, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: 1.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: 1.exeReversingLabs: Detection: 50%
Source: 1.exeVirustotal: Detection: 51%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 98.9% probability
Source: 1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036212878.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036604326.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: 1.exe, 00000000.00000003.2033316380.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 1.exe, 00000000.00000003.2034131917.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033108865.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035374269.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035915792.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036702135.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 1.exe, 00000000.00000003.2030310399.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033524827.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: 1.exe, 00000000.00000003.2030494414.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035544467.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035205300.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035791816.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033177993.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 1.exe, 00000000.00000003.2034682713.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: 1.exe, 00000000.00000003.2032963298.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033247099.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035711607.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 1.exe, 00000000.00000003.2034915497.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: 1.exe, 00000000.00000003.2030494414.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036888029.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033452321.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 1.exe, 00000000.00000003.2035294894.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 1.exe, 00000000.00000003.2034317373.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033032716.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035624504.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 1.exe, 00000000.00000003.2030310399.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32trace.pdb source: 1.exe, 00000000.00000003.2056254055.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036295660.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 1.exe, 00000000.00000003.2034058778.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 1.exe, 00000000.00000003.2034773015.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 1.exe, 00000000.00000003.2034211271.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036390732.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036977171.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035024973.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035463779.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035112936.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: 1.exe, 00000000.00000003.2033383204.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036488537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033795752.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: 1.exe, 00000000.00000003.2032881754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033639541.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035998878.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036795229.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19579B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF7E19579B0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19585A0 FindFirstFileExW,FindClose,0_2_00007FF7E19585A0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1970B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7E1970B84
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922Jump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32Jump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922\pythonwinJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-console-l1-1-0.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922\win32Jump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-datetime-l1-1-0.dllJump to behavior
Source: Joe Sandbox ViewIP Address: 208.95.112.1 208.95.112.1
Source: unknownDNS query: name: ip-api.com
Source: unknownDNS query: name: ipinfo.io
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /json/?fields=hosting,query HTTP/1.1Host: ip-api.comUser-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflateAccept: */*Connection: keep-alive
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: global trafficDNS traffic detected: DNS query: idefasoft.fr
Source: global trafficDNS traffic detected: DNS query: tiktok.com
Source: global trafficDNS traffic detected: DNS query: ip-api.com
Source: global trafficDNS traffic detected: DNS query: ipinfo.io
Source: global trafficDNS traffic detected: DNS query: api.gofile.io
Source: global trafficDNS traffic detected: DNS query: transfer.sh
Source: 1.exe, 00000002.00000003.3035920928.0000017A3B63B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043851224.0000017A3B644000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcp
Source: 1.exe, 00000002.00000003.3035036468.0000017A3BAE7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047292326.0000017A3BAC9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040787963.0000017A3A5B5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042535363.0000017A3B788000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042759887.0000017A3BA37000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041374609.0000017A3BB1B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061076963.0000017A3BACF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042333473.0000017A3BA96000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041546488.0000017A3BA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032881754.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050331000.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032881754.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/RapidSSLTLSDVRSAMixedSHA2562020CA-1.crt
Source: 1.exe, 00000002.00000003.3042660136.0000017A3ADEF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076775219.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034119233.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3049433453.0000017A3ABC5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035717266.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053378498.0000017A3ADFE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058556484.0000017A3AAB2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048191712.0000017A3ABBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3038202220.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2074696121.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048315405.0000017A3ADFD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047326892.0000017A3ADF5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2078098059.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3050933300.0000017A3ADFE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061688057.0000017A3AABD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2070576133.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041046094.0000017A3ABBD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2080221915.0000017A3ADDE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3ABBD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: 1.exe, 00000002.00000003.3054737249.0000017A3ABD9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2070473934.0000017A3AC3A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041905028.0000017A3ABD5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076775219.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3049433453.0000017A3ABD9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076232061.0000017A3ABCA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2074696121.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046016318.0000017A3ABD9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2078098059.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3038616443.0000017A3ABC9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042404909.0000017A3ABD8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059519843.0000017A3ABDD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2070576133.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076920432.0000017A3ABD2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3ABBD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043762058.0000017A3BB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: 1.exe, 00000002.00000003.3061197450.0000017A3B705000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3052626504.0000017A387A8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051508240.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044166321.0000017A3B6E4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039691074.0000017A3B6E4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042600296.0000017A38790000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041937878.0000017A38778000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 1.exe, 00000002.00000003.3054243290.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3033943293.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042437768.0000017A3B8A1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046937631.0000017A3B8A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: 1.exe, 00000002.00000003.3054243290.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3033943293.0000017A3B776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl:z
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043762058.0000017A3BB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043762058.0000017A3BB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl4
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl=
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048578064.0000017A3BB92000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048578064.0000017A3BB92000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: 1.exe, 00000002.00000003.3045170741.0000017A3BAA5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042333473.0000017A3BA96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032881754.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050331000.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 1.exe, 00000000.00000003.2032881754.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/RapidSSLTLSDVRSAMixedSHA2562020CA-1.crl
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/RapidSSLTLSDVRSAMixedSHA2562020CA-1.crl
Source: 1.exe, 00000002.00000003.3058967461.0000017A3BACE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045170741.0000017A3BAA5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047292326.0000017A3BAC9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040787963.0000017A3A5B5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061076963.0000017A3BACF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042333473.0000017A3BA96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3033943293.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044166321.0000017A3B6BB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3062873353.0000017A3B6C0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039691074.0000017A3B6B7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035036468.0000017A3BAE7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042535363.0000017A3B788000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041374609.0000017A3BB1B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058967461.0000017A3BACE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045012618.0000017A3AB36000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047456493.0000017A3BAAD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043146851.0000017A3BBB8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056719202.0000017A3BAAE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045170741.0000017A3BAA5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058556484.0000017A3AAB2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047292326.0000017A3BAC9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061076963.0000017A3BACF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042333473.0000017A3BA96000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: 1.exe, 00000002.00000003.2076775219.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076232061.0000017A3ABCA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2074696121.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2078098059.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2070576133.0000017A3ABC0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076920432.0000017A3ABD2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: 1.exe, 00000002.00000003.3043851224.0000017A3B634000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036160557.0000017A3B62B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043908220.0000017A3B63A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/unittest.html
Source: 1.exe, 00000002.00000003.3042660136.0000017A3ADEF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034119233.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053077672.0000017A3AE11000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035717266.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3038202220.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048315405.0000017A3ADFD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047326892.0000017A3ADF5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3050933300.0000017A3ADFE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056684147.0000017A3AE13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: 1.exe, 00000002.00000003.3037300715.0000017A3BA31000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3062055214.0000017A3BA38000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042759887.0000017A3BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: 1.exe, 00000002.00000003.3037300715.0000017A3BA31000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042759887.0000017A3BA37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: powershell.exe, 0000001B.00000002.2298150124.000001CE3F072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2284479122.000001CE30795000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2298150124.000001CE3EF3B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: 1.exe, 00000002.00000003.3052626504.0000017A387A8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051508240.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042600296.0000017A38790000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041937878.0000017A38778000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
Source: 1.exe, 00000002.00000003.3051462731.0000017A3AB19000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
Source: 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032881754.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032881754.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050331000.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000001B.00000002.2284479122.000001CE3070E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: 1.exe, 00000002.00000003.3054243290.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3033943293.0000017A3B776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: 1.exe, 00000002.00000003.3047456493.0000017A3BAAD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056719202.0000017A3BAAE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045170741.0000017A3BAA5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042333473.0000017A3BA96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/8B
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/Cd
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/CdSe
Source: 1.exe, 00000002.00000003.3054243290.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3033943293.0000017A3B776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/en
Source: powershell.exe, 0000001B.00000002.2284479122.000001CE2EEC1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 1.exe, 00000002.00000003.3042660136.0000017A3ADEF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044166321.0000017A3B6BB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034119233.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041546488.0000017A3B932000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053077672.0000017A3AE11000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035717266.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3038202220.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039691074.0000017A3B6B7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048315405.0000017A3ADFD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047326892.0000017A3ADF5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046492479.0000017A3B933000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3050933300.0000017A3ADFE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056684147.0000017A3AE13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: 1.exe, 00000002.00000003.3052626504.0000017A387A8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051508240.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051462731.0000017A3AB19000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042600296.0000017A38790000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041937878.0000017A38778000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: 1.exe, 00000002.00000003.3051462731.0000017A3AB19000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043762058.0000017A3BB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: 1.exe, 00000002.00000003.3051462731.0000017A3AB19000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043762058.0000017A3BB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051462731.0000017A3AB19000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
Source: powershell.exe, 0000001B.00000002.2284479122.000001CE3070E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034119233.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043146851.0000017A3BBB8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047805687.0000017A3BBDB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058449892.0000017A3ADD4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035717266.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3038202220.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047837548.0000017A3BBDF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043146851.0000017A3BBB8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047805687.0000017A3BBDB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047837548.0000017A3BBDF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/G
Source: 1.exe, 00000002.00000003.2067027877.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068286975.0000017A3ABB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067027877.0000017A3AB48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068023103.0000017A3ABAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: 1.exe, 00000002.00000003.3059592068.0000017A3BAF5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046492479.0000017A3BA2B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037300715.0000017A3BA31000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3062055214.0000017A3BA38000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035036468.0000017A3BAE7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042759887.0000017A3BA37000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041546488.0000017A3BA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2051546160.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2049289450.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044118745.0000017A3BBEB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043146851.0000017A3BBB8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044779649.0000017A3BC07000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051462731.0000017A3AB19000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: 1.exe, 00000002.00000003.3061197450.0000017A3B705000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044166321.0000017A3B6E4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039691074.0000017A3B6E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: 1.exe, 00000002.00000003.2067027877.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067835413.0000017A3A76F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067085289.0000017A3A76E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: 1.exe, 00000002.00000003.3057024319.0000017A3BCEC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoftPGRAD~1.JSOy.z
Source: 1.exe, 00000002.00000003.2067027877.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068286975.0000017A3ABB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067027877.0000017A3AB48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068023103.0000017A3ABAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: 1.exe, 00000002.00000003.3053446059.0000017A3BC6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058225119.0000017A3BC6D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3060537279.0000017A3BC79000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042437768.0000017A3B8A1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056117482.0000017A3BC6D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058929431.0000017A3BC78000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046937631.0000017A3B8A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: 1.exe, 00000002.00000003.3040787963.0000017A3A5B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://MD8.mozilla.org/1/m
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 0000001B.00000002.2284479122.000001CE2EEC1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blog.jaraco.com/skeleton
Source: 1.exe, 00000002.00000003.3060113758.0000017A3BD48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2191949277.0000017A3BD47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://boxmatrix.info/wiki/Property:arping
Source: 1.exe, 00000002.00000003.2140790853.0000017A3CCED000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056117482.0000017A3BCBF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053446059.0000017A3BCBF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://brew.sh
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3054778444.0000017A3CDF3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2194817044.0000017A3CDF3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3033363208.0000017A3CDF3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://codecov.io/gh/pypa/setuptools
Source: powershell.exe, 0000001B.00000002.2298150124.000001CE3EF3B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001B.00000002.2298150124.000001CE3EF3B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001B.00000002.2298150124.000001CE3EF3B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/installation/
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptography.io/en/latest/security/
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/channels/803025117553754132/815945031150993468
Source: 1.exe, 00000002.00000003.3058929431.0000017A3BC78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discordverify.tech/webhooks/hyzen_exod/
Source: 1.exe, 00000002.00000003.3037056352.0000017A3A4FD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044385211.0000017A3A537000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041276011.0000017A3A536000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039609311.0000017A3A500000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039874939.0000017A3A52F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058622125.0000017A3A549000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046082292.0000017A3A537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: 1.exe, 00000002.00000003.2066280806.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068345390.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076996776.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2066065840.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2075124048.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034959002.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2080508443.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040956293.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045780862.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067085289.0000017A3A726000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: 1.exe, 00000002.00000003.3041310003.0000017A3A66B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3062686164.0000017A3A698000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045575233.0000017A3A698000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037789521.0000017A3A657000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051864023.0000017A3A698000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042279402.0000017A3A697000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040522447.0000017A3A658000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040851429.0000017A3A668000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html
Source: 1.exe, 00000002.00000003.3041310003.0000017A3A66B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3062686164.0000017A3A698000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045575233.0000017A3A698000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037789521.0000017A3A657000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051864023.0000017A3A698000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042279402.0000017A3A697000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040522447.0000017A3A658000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040851429.0000017A3A668000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/pprint.html#pprint.pprint
Source: 1.exe, 00000002.00000003.2076513899.0000017A3AD11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
Source: 1.exe, 00000002.00000003.2076513899.0000017A3ACD2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076513899.0000017A3AD11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
Source: 1.exe, 00000002.00000003.3054041207.0000017A3BA90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: powershell.exe, 0000001B.00000002.2284479122.000001CE3070E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: 1.exe, 00000002.00000003.3060113758.0000017A3BD48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2191949277.0000017A3BD47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ThomasHabets/arping
Source: 1.exe, 00000002.00000003.3041344247.0000017A387B1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060985301.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060791331.0000017A387B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 1.exe, 00000000.00000003.2052790145.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053042119.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030030525.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2056376323.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055957694.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2056254055.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2056254055.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2056078608.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mhammond/pywin32
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/black
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/actions?query=workflow%3A%22tests%22
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/discussions
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/workflows/tests/badge.svg
Source: 1.exe, 00000002.00000003.2080221915.0000017A3ADDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
Source: 1.exe, 00000002.00000003.2060791331.0000017A387B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 1.exe, 00000002.00000003.3041344247.0000017A387B1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060985301.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060791331.0000017A387B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 1.exe, 00000002.00000003.3040522447.0000017A3A658000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061936176.0000017A3A65B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/863
Source: 1.exe, 00000002.00000003.3037056352.0000017A3A4FD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044385211.0000017A3A537000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041276011.0000017A3A536000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2064096224.0000017A3A6CB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039609311.0000017A3A500000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2065358830.0000017A3A523000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2065201994.0000017A3A4EC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2064210655.0000017A3A6D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061014733.0000017A3A54C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039874939.0000017A3A52F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058622125.0000017A3A549000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046082292.0000017A3A537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: 1.exe, 00000002.00000003.3037789521.0000017A3A657000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2064902810.0000017A3A64D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2065830974.0000017A3A606000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067085289.0000017A3A606000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2066280806.0000017A3A606000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/863i
Source: 1.exe, 00000002.00000003.3041344247.0000017A387B1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060985301.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060791331.0000017A387B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: 1.exe, 00000002.00000003.3060055871.0000017A3AAEC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3054041207.0000017A3BA90000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037300715.0000017A3BA31000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037864648.0000017A3A73B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061835558.0000017A3BA32000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3052255260.0000017A3A753000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040956293.0000017A3A73C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034959002.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3060982470.0000017A3A75D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041120592.0000017A3A752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: 1.exe, 00000002.00000003.3060055871.0000017A3AAEC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037300715.0000017A3BA31000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061835558.0000017A3BA32000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
Source: 1.exe, 00000002.00000003.3040787963.0000017A3A5B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: 1.exe, 00000002.00000003.3041120592.0000017A3A752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: 1.exe, 00000002.00000003.3054243290.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045012618.0000017A3AB36000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3033943293.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047456493.0000017A3BAAD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056719202.0000017A3BAAE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045170741.0000017A3BAA5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042333473.0000017A3BA96000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: 1.exe, 00000002.00000003.3053812713.0000017A3B7F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/code%20style-black-000000.svg
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/skeleton-2022-informational
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/discord/803025117553754132
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/setuptools.svg
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/setuptools.svg
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/readthedocs/setuptools/latest.svg
Source: 1.exe, 00000002.00000003.3037700559.0000017A3B60D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040522447.0000017A3A658000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041153135.0000017A3A69D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3050933300.0000017A3ADFE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040851429.0000017A3A668000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3052774406.0000017A3B72B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2080221915.0000017A3ADDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
Source: 1.exe, 00000002.00000003.3054041207.0000017A3BA90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: powershell.exe, 0000001B.00000002.2298150124.000001CE3F072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2284479122.000001CE30795000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2298150124.000001CE3EF3B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: 1.exe, 00000002.00000003.3055082529.0000017A3B90B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053783116.0000017A3B6AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: 1.exe, 00000002.00000003.3060113758.0000017A3BD48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2191949277.0000017A3BD47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packages.debian.org/sid/iputils-arping
Source: 1.exe, 00000002.00000003.3042660136.0000017A3ADEF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034119233.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035717266.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053378498.0000017A3ADFE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2080459542.0000017A3B691000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3038202220.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048315405.0000017A3ADFD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047326892.0000017A3ADF5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3050933300.0000017A3ADFE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2080221915.0000017A3ADDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/installing/
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/cryptography/
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/setuptools
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/pypa/setuptools/main/docs/images/banner-640x320.svg
Source: 1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: 1.exe, 00000002.00000003.3053812713.0000017A3B7F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/
Source: 1.exe, 00000002.00000003.2066280806.0000017A3A5BA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067027877.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2074696121.0000017A3AB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076775219.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053018848.0000017A3ABAB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2078098059.0000017A3AB50000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068023103.0000017A3ABAF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041046094.0000017A3AB66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048191712.0000017A3ABAA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2066211223.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2070576133.0000017A3AB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AB50000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068641821.0000017A3ABAF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3057121566.0000017A3ABAF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053109367.0000017A3ABAD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/stable/history.html
Source: 1.exe, 00000002.00000003.3041973003.0000017A3AC2A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051198994.0000017A3AC31000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045012618.0000017A3AB50000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076513899.0000017A3ACD2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3062217545.0000017A3AD16000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037571529.0000017A3AD06000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034119233.0000017A3AD06000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3054419957.0000017A3AD0A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037789521.0000017A3A657000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044321974.0000017A3AD06000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3038616443.0000017A3AC2A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048428339.0000017A3AC30000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2078098059.0000017A3AB50000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2078098059.0000017A3AC2A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034119233.0000017A3AC2A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040522447.0000017A3A658000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041153135.0000017A3A69D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3049760226.0000017A3AD0A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040851429.0000017A3A668000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AB50000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045224507.0000017A3AD07000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
Source: 1.exe, 00000002.00000003.2168054885.0000017A3D041000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2166742734.0000017A3CE10000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169489926.0000017A3CE10000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2173691185.0000017A3BDB6000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2173937925.0000017A3CE10000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169885308.0000017A3BDB6000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2174728029.0000017A3D041000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
Source: 1.exe, 00000002.00000003.2168838863.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2145787875.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192175449.0000017A3CE59000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3054548134.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 1.exe, 00000002.00000003.2191949277.0000017A3BD80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2163066519.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3055568442.0000017A3BD86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2168838863.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2174128521.0000017A3BD85000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2195041697.0000017A3BD84000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2145787875.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192175449.0000017A3CE59000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034581211.0000017A3BD7E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034616679.0000017A3BD84000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3054548134.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefox
Source: 1.exe, 00000002.00000003.2165342258.0000017A3CE83000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047233307.0000017A3CD3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 1.exe, 00000002.00000003.2174728029.0000017A3D041000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.orgw
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/github/pypa/setuptools?style=flat
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/security
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=readme
Source: 1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral
Source: 1.exe, 00000002.00000003.3058347091.0000017A3B6AE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053783116.0000017A3B6AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: 1.exe, 00000002.00000003.3059592068.0000017A3BAF5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046492479.0000017A3BA2B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037300715.0000017A3BA31000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3062055214.0000017A3BA38000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035036468.0000017A3BAE7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042759887.0000017A3BA37000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041546488.0000017A3BA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: 1.exe, 00000002.00000003.3054041207.0000017A3BA90000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037864648.0000017A3A73B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3052255260.0000017A3A753000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040956293.0000017A3A73C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034959002.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3060982470.0000017A3A75D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041120592.0000017A3A752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://weibo.com/
Source: 1.exe, 00000002.00000003.3042251531.0000017A3A4B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041698267.0000017A3A4AD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037833269.0000017A3A4A8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058185360.0000017A3A4B9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046206555.0000017A3A4B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
Source: 1.exe, 00000000.00000003.2046396219.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
Source: 1.exe, 00000000.00000003.2046478664.00000252636D3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2046396219.00000252636D3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2046396219.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ctrip.com/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.co.uk/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/
Source: 1.exe, 00000002.00000003.3035920928.0000017A3B63B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043851224.0000017A3B644000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058556484.0000017A3AAB2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
Source: 1.exe, 00000002.00000003.3053446059.0000017A3BC6B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059592068.0000017A3BAF5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058225119.0000017A3BC6D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3060537279.0000017A3BC6E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035036468.0000017A3BAE7000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056117482.0000017A3BC6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.manpagez.com/man/8/networksetup/
Source: 1.exe, 00000002.00000003.2168054885.0000017A3D041000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2166742734.0000017A3CE10000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169489926.0000017A3CE10000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2173691185.0000017A3BDB6000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2173937925.0000017A3CE10000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169885308.0000017A3BDB6000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176480211.0000017A3E448000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2174728029.0000017A3D041000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
Source: 1.exe, 00000002.00000003.3033614121.0000017A3CE23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2163066519.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2193712911.0000017A3CE23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2168838863.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2173937925.0000017A3CE13000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3054778444.0000017A3CE23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2166545220.0000017A3CE23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2145787875.0000017A3CE23000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2145787875.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056035916.0000017A3CE24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/
Source: 1.exe, 00000002.00000003.2165342258.0000017A3CE83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 1.exe, 00000002.00000003.2168838863.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2145787875.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192175449.0000017A3CE59000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3054548134.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/
Source: 1.exe, 00000002.00000003.2165342258.0000017A3CE83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 1.exe, 00000002.00000003.2163066519.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2168838863.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2145787875.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 1.exe, 00000002.00000003.2164573073.0000017A3CEB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2175029957.0000017A3D236000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165342258.0000017A3CE83000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2172953776.0000017A3CEB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 1.exe, 00000002.00000003.2165342258.0000017A3CE83000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2163066519.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2168838863.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2145787875.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 1.exe, 00000002.00000003.2145787875.0000017A3CE10000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051462731.0000017A3AB19000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: 1.exe, 00000002.00000003.2165342258.0000017A3CE83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 1.exe, 00000002.00000003.2165342258.0000017A3CE83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
Source: 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/H
Source: 1.exe, 00000002.00000003.3056117482.0000017A3BC5F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3060537279.0000017A3BC67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/docs/manmaster/man5/
Source: 1.exe, 00000002.00000003.3053812713.0000017A3B7F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: 1.exe, 00000002.00000003.3054041207.0000017A3BA90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
Source: 1.exe, 00000002.00000003.2059927991.0000017A3A513000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2059853909.0000017A3A4FB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2059853909.0000017A3A50E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
Source: 1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.zhihu.com/
Source: 1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3052032179.0000017A3BBDC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043146851.0000017A3BBB8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047805687.0000017A3BBDB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3052569220.0000017A3BBDD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
Source: 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: 1.exe, 00000002.00000003.3060055871.0000017A3AAEC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037300715.0000017A3BA31000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061835558.0000017A3BA32000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49952
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49952 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49947 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49899 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49899
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1975C740_2_00007FF7E1975C74
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E196FBD80_2_00007FF7E196FBD8
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1974F100_2_00007FF7E1974F10
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19510000_2_00007FF7E1951000
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1967AAC0_2_00007FF7E1967AAC
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1978A380_2_00007FF7E1978A38
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19612800_2_00007FF7E1961280
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1960A600_2_00007FF7E1960A60
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19691B00_2_00007FF7E19691B0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E196D2000_2_00007FF7E196D200
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E197518C0_2_00007FF7E197518C
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1962CC40_2_00007FF7E1962CC4
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19614840_2_00007FF7E1961484
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1960C640_2_00007FF7E1960C64
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19733BC0_2_00007FF7E19733BC
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19673F40_2_00007FF7E19673F4
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1958B200_2_00007FF7E1958B20
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1970B840_2_00007FF7E1970B84
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1960E700_2_00007FF7E1960E70
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19595FB0_2_00007FF7E19595FB
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E196CD6C0_2_00007FF7E196CD6C
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19628C00_2_00007FF7E19628C0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19650400_2_00007FF7E1965040
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E196D8800_2_00007FF7E196D880
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19610740_2_00007FF7E1961074
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1959FCD0_2_00007FF7E1959FCD
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E195979B0_2_00007FF7E195979B
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1972F200_2_00007FF7E1972F20
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19757280_2_00007FF7E1975728
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1961F300_2_00007FF7E1961F30
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E196FBD80_2_00007FF7E196FBD8
Source: C:\Users\user\Desktop\1.exeCode function: String function: 00007FF7E19525F0 appears 50 times
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: python3.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: 1.exe, 00000000.00000003.2035711607.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2033177993.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2033383204.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2054355975.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameucrtbase.dllj% vs 1.exe
Source: 1.exe, 00000000.00000003.2036295660.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2050878278.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs 1.exe
Source: 1.exe, 00000000.00000003.2052790145.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepythoncom311.dll0 vs 1.exe
Source: 1.exe, 00000000.00000003.2036795229.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2036604326.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2030310399.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs 1.exe
Source: 1.exe, 00000000.00000003.2053931174.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs 1.exe
Source: 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2050481524.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs 1.exe
Source: 1.exe, 00000000.00000003.2035998878.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2030494414.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs 1.exe
Source: 1.exe, 00000000.00000003.2035294894.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2034682713.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2034317373.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2053042119.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepywintypes311.dll0 vs 1.exe
Source: 1.exe, 00000000.00000003.2030030525.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2036702135.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2032614855.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2056376323.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshell.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2033316380.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2034131917.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2036488537.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2031871197.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2035205300.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2035544467.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2033452321.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2032754537.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2034211271.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2036390732.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2035915792.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2055957694.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2033795752.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2035024973.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2035374269.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2056254055.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2056254055.00000252636D2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2031707602.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2034915497.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2035112936.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2034773015.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2034058778.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2033108865.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2056078608.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs 1.exe
Source: 1.exe, 00000000.00000003.2033524827.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2035463779.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2033032716.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2032963298.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2036212878.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2036977171.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2036888029.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2035624504.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2035791816.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2033639541.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: 1.exe, 00000000.00000003.2032881754.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs 1.exe
Source: 1.exe, 00000000.00000003.2033247099.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs 1.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
Source: classification engineClassification label: mal96.spyw.evad.winEXE@61/210@6/6
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19529E0 GetLastError,FormatMessageW,MessageBoxW,0_2_00007FF7E19529E0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6276:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4688:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5344:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2000:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6552:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1292:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6496:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4508:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_03
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922Jump to behavior
Source: 1.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "exodus.exe")
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "exodus.exe")
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
Source: C:\Users\user\Desktop\1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: 1.exeReversingLabs: Detection: 50%
Source: 1.exeVirustotal: Detection: 51%
Source: C:\Users\user\Desktop\1.exeFile read: C:\Users\user\Desktop\1.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /f /im exodus.exe"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im exodus.exe
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get name
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get TotalPhysicalMemory
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuidJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nulJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nulJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /f /im exodus.exe"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefaultJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductNameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get TotalPhysicalMemoryJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDescJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderNameJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ClipboardJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayNameJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im exodus.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
Source: C:\Users\user\Desktop\1.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: libffi-8.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: libssl-3.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: sqlite3.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: version.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dll
Source: C:\Windows\System32\wbem\WMIC.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
Source: 1.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: 1.exeStatic file information: File size 25435744 > 1048576
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: 1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036212878.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036604326.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: 1.exe, 00000000.00000003.2033316380.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 1.exe, 00000000.00000003.2034131917.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033108865.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035374269.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035915792.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036702135.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 1.exe, 00000000.00000003.2030310399.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: 1.exe, 00000000.00000003.2032268325.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033524827.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: 1.exe, 00000000.00000003.2030494414.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035544467.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035205300.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035791816.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 1.exe, 00000000.00000003.2032034410.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033177993.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 1.exe, 00000000.00000003.2034682713.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: 1.exe, 00000000.00000003.2032963298.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: 1.exe, 00000000.00000003.2030580754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033247099.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035711607.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 1.exe, 00000000.00000003.2030676349.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 1.exe, 00000000.00000003.2034915497.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 1.exe, 00000000.00000003.2032504071.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: 1.exe, 00000000.00000003.2030494414.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036888029.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 1.exe, 00000000.00000003.2055498131.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033452321.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 1.exe, 00000000.00000003.2035294894.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 1.exe, 00000000.00000003.2034317373.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: 1.exe, 00000000.00000003.2032340551.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033032716.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035624504.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 1.exe, 00000000.00000003.2030310399.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32trace.pdb source: 1.exe, 00000000.00000003.2056254055.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036295660.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 1.exe, 00000000.00000003.2034058778.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 1.exe, 00000000.00000003.2034773015.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: 1.exe, 00000000.00000003.2053191982.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 1.exe, 00000000.00000003.2034211271.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036390732.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036977171.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035024973.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035463779.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035112936.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: 1.exe, 00000000.00000003.2033383204.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 1.exe, 00000000.00000003.2032159357.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036488537.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033795752.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: 1.exe, 00000000.00000003.2032881754.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 1.exe, 00000000.00000003.2032425609.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 1.exe, 00000000.00000003.2033639541.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 1.exe, 00000000.00000003.2051008596.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 1.exe, 00000000.00000003.2035998878.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 1.exe, 00000000.00000003.2036795229.00000252636C5000.00000004.00000020.00020000.00000000.sdmp
Source: 1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

barindex
Suspicious powershell command line found
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefaultJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductNameJump to behavior
Source: api-ms-win-core-file-l1-2-0.dll.0.drStatic PE information: 0x6A762B3D [Fri Aug 7 19:00:13 2026 UTC]
Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
Source: python311.dll.0.drStatic PE information: section name: PyRuntim
Source: mfc140u.dll.0.drStatic PE information: section name: .didat
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 27_2_00007FF846E219BB pushad ; ret 27_2_00007FF846E219C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 30_2_00007FF846E50D20 push eax; retf 30_2_00007FF846E50D4D

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\1.exeProcess created: "C:\Users\user\Desktop\1.exe"
Uses cmd line tools excessively to alter registry or file data
Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\VCRUNTIME140_1.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\win32com\shell\shell.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_webp.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\win32\win32crypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imagingmath.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32\pywintypes311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_cffi_backend.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin\win32ui.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_sqlite3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\win32\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\libssl-3.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\win32\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\sqlite3.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imagingcms.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imaging.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\ucrtbase.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\win32\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\select.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\libffi-8.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imagingtk.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32\pythoncom311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1956EA0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF7E1956EA0
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\1.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk\Enum name: 0Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3602
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1711
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3246
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 755
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3076
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 987
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\win32com\shell\shell.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_webp.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\win32\win32crypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imagingmath.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography\hazmat\bindings\_rust.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32\pywintypes311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_cffi_backend.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin\win32ui.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ec_ws.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_sqlite3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\win32\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Util\_strxor.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\win32\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imagingcms.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_ed448.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_x25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_ghash_portable.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imaging.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_ed25519.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_poly1305.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_keccak.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Math\_modexp.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\win32\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\select.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Protocol\_scrypt.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imagingtk.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32\pythoncom311.dllJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Util\_cpuid_c.pydJump to dropped file
Source: C:\Users\user\Desktop\1.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-17039
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6188Thread sleep count: 3602 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6048Thread sleep count: 1711 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4324Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4088Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 344Thread sleep count: 3246 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 344Thread sleep count: 755 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3220Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2848Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5972Thread sleep count: 3076 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6768Thread sleep count: 987 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1248Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 320Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\1.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19579B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF7E19579B0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E19585A0 FindFirstFileExW,FindClose,0_2_00007FF7E19585A0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1970B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF7E1970B84
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922Jump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32Jump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922\pythonwinJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-console-l1-1-0.dllJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922\win32Jump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-datetime-l1-1-0.dllJump to behavior
Source: 1.exe, 00000000.00000003.2038864150.00000252636C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: 1.exe, 00000002.00000003.3037789521.0000017A3A657000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076996776.0000017A3A699000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2075124048.0000017A3A69D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040522447.0000017A3A658000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041153135.0000017A3A69D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067085289.0000017A3A69D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040851429.0000017A3A668000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2065830974.0000017A3A69D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2066280806.0000017A3A69D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWz
Source: C:\Users\user\Desktop\1.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1969924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7E1969924
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1972790 GetProcessHeap,0_2_00007FF7E1972790
Source: C:\Users\user\Desktop\1.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\tasklist.exeProcess token adjusted: Debug
Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1969924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7E1969924
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E195C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF7E195C44C
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E195BBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF7E195BBC0
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E195C62C SetUnhandledExceptionFilter,0_2_00007FF7E195C62C
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuidJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nulJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nulJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /f /im exodus.exe"Jump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefaultJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductNameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get TotalPhysicalMemoryJump to behavior
Source: C:\Users\user\Desktop\1.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDescJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderNameJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ClipboardJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayNameJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im exodus.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /f /im exodus.exe
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1978880 cpuid 0_2_00007FF7E1978880
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Util VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Util VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\certifi VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info\license_files VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\ucrtbase.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-console-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-datetime-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-errorhandling-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l1-2-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l2-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-handle-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-heap-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-interlocked-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-libraryloader-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-memory-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processenvironment-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processthreads-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-profile-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-math-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-multibyte-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-process-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-stdio-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-string-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-utility-l1-1-0.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\certifi VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pyexpat.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\python3.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\sqlite3.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\ucrtbase.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\_sqlite3.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pyexpat.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32\pywintypes311.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32\pythoncom311.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32com VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32com VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\Desktop\1.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI63922 VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E195C330 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF7E195C330
Source: C:\Users\user\Desktop\1.exeCode function: 0_2_00007FF7E1974F10 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF7E1974F10
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct

Stealing of Sensitive Information

barindex
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 1.exe, 00000002.00000003.2140609288.0000017A3BD78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets
Source: 1.exe, 00000002.00000003.2140609288.0000017A3BD78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet1
Source: 1.exe, 00000002.00000003.2140609288.0000017A3BD78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: 1.exe, 00000002.00000003.3053446059.0000017A3BC6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: async setPassphrase(e){const embed={color:3553599,title:"Exodus Injection",fields:[{name:"Passwords:",value:`${e}
Source: 1.exe, 00000002.00000003.2140609288.0000017A3BD78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: 1.exe, 00000002.00000003.2140609288.0000017A3BD78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: 1.exe, 00000002.00000003.2140609288.0000017A3BD78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\1.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjpJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pingsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10Jump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdoJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgppJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhmJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjihJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanentJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpaJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareportingJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmpJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.defaultJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemgJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backupsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chromeJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_stateJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneecJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\dbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaadJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\eventsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archivedJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BookmarksJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporaryJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumpsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfndJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\defaultJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removedJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdnoJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackupsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdmaJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofecJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieafJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnnegphlobjdpkhecapkijjdkgcjhkibJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storageJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbaiJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\eventsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\ProfilesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqliteJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgkJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension SettingsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-releaseJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnkJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\gleanJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.filesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashesJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pingsJump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xmlJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\walletsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\walletsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldbJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
Tries to steal communication platform credentials (via file / registry access)
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\DiscordJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\DiscordCanaryJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\DiscordPTBJump to behavior
Source: C:\Users\user\Desktop\1.exeFile opened: C:\Users\user\AppData\Local\DiscordDevelopmentJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts31
Windows Management Instrumentation		1
DLL Side-Loading		1
DLL Side-Loading		1
Disable or Modify Tools		2
OS Credential Dumping		2
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Native API		Boot or Logon Initialization Scripts11
Process Injection		1
Deobfuscate/Decode Files or Information		1
Credentials in Registry		2
File and Directory Discovery		Remote Desktop Protocol4
Data from Local System		12
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Command and Scripting Interpreter		Logon Script (Windows)Logon Script (Windows)2
Obfuscated Files or Information		Security Account Manager34
System Information Discovery		SMB/Windows Admin Shares1
Email Collection		2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts1
PowerShell		Login HookLogin Hook1
Timestomp		NTDS61
Security Software Discovery		Distributed Component Object Model1
Clipboard Data		3
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading		LSA Secrets2
Process Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Modify Registry		Cached Domain Credentials51
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items51
Virtualization/Sandbox Evasion		DCSync1
Application Window Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
Process Injection		Proc Filesystem1
System Network Configuration Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1585170 Sample: 1.exe Startdate: 07/01/2025 Architecture: WINDOWS Score: 96 52 transfer.sh 2->52 54 tiktok.com 2->54 56 4 other IPs or domains 2->56 66 Antivirus / Scanner detection for submitted sample 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 AI detected suspicious sample 2->70 9 1.exe 213 2->9         started        signatures3 process4 file5 44 C:\Users\user\AppData\Local\...\shell.pyd, PE32+ 9->44 dropped 46 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 9->46 dropped 48 C:\Users\user\AppData\...\win32crypt.pyd, PE32+ 9->48 dropped 50 162 other files (none is malicious) 9->50 dropped 72 Suspicious powershell command line found 9->72 74 Found pyInstaller with non standard icon 9->74 13 1.exe 31 9->13         started        signatures6 process7 dnsIp8 58 ip-api.com 208.95.112.1, 49707, 80 TUT-ASUS United States 13->58 60 idefasoft.fr 151.80.152.246, 443, 49705, 49708 OVHFR Italy 13->60 62 4 other IPs or domains 13->62 76 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->76 78 Suspicious powershell command line found 13->78 80 Found many strings related to Crypto-Wallets (likely being stolen) 13->80 82 4 other signatures 13->82 17 cmd.exe 1 13->17         started        20 cmd.exe 1 13->20         started        22 cmd.exe 1 13->22         started        24 12 other processes 13->24 signatures9 process10 signatures11 64 Uses cmd line tools excessively to alter registry or file data 17->64 26 conhost.exe 17->26         started        28 reg.exe 1 17->28         started        30 conhost.exe 20->30         started        32 reg.exe 1 20->32         started        34 conhost.exe 22->34         started        36 conhost.exe 24->36         started        38 conhost.exe 24->38         started        40 conhost.exe 24->40         started        42 14 other processes 24->42 process12

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
1.exe50%ReversingLabsWin64.Trojan.ReverseShell
1.exe51%VirustotalBrowse
1.exe100%AviraTR/PSW.Agent.buior

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_BLAKE2s.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD5.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_RIPEMD160.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA1.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA224.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA256.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA384.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA512.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_ghash_clmul.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_ghash_portable.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_keccak.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_poly1305.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Math\_modexp.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Protocol\_scrypt.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ec_ws.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ed25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ed448.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_x25519.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Util\_cpuid_c.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Util\_strxor.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_ARC4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_Salsa20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_chacha20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_pkcs1_decode.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_aes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_aesni.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_arc2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_blowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cast.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cbc.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cfb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ctr.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_des.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_des3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ecb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ocb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ofb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_BLAKE2b.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_BLAKE2s.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD5.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_RIPEMD160.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.microsoftPGRAD~1.JSOy.z0%Avira URL Cloudsafe
https://discordverify.tech/webhooks/hyzen_exod/0%Avira URL Cloudsafe
http://repository.swisssign.com/Cd0%Avira URL Cloudsafe
https://tidelift.com/security0%Avira URL Cloudsafe
https://boxmatrix.info/wiki/Property:arping0%Avira URL Cloudsafe
http://repository.swisssign.com/en0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
idefasoft.fr
151.80.152.246
truefalse
    		unknown
    tiktok.com
    		18.66.112.128
    		truefalse
      		high
      ipinfo.io
      		34.117.59.81
      		truefalse
        		high
        ip-api.com
        		208.95.112.1
        		truefalse
          		high
          transfer.sh
          		144.76.136.153
          		truefalse
            		high
            api.gofile.io
            		45.112.123.126
            		truefalse
              		high

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              http://ip-api.com/json/?fields=hosting,queryfalse
                		high

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://aka.ms/vcp1.exe, 00000002.00000003.3035920928.0000017A3B63B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043851224.0000017A3B644000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf1.exe, 00000002.00000003.3055082529.0000017A3B90B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053783116.0000017A3B6AD000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://www.avito.ru/1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      https://img.shields.io/badge/skeleton-2022-informational1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://github.com/mhammond/pywin321.exe, 00000000.00000003.2052790145.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2053042119.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2030030525.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2056376323.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2055957694.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2056254055.00000252636C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2056254055.00000252636D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2056078608.00000252636C5000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://www.ctrip.com/1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://img.shields.io/pypi/pyversions/setuptools.svg1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://img.shields.io/pypi/v/setuptools.svg1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://crl.dhimyotis.com/certignarootca.crl41.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043762058.0000017A3BB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://docs.python.org/library/unittest.html1.exe, 00000002.00000003.3043851224.0000017A3B634000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036160557.0000017A3B62B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043908220.0000017A3B63A000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#1.exe, 00000002.00000003.3041344247.0000017A387B1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060985301.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060791331.0000017A387B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://www.leboncoin.fr/1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        http://crl.dhimyotis.com/certignarootca.crl=1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/pyca/cryptography/actions?query=workflow%3ACI1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://tidelift.com/security1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://tools.ietf.org/html/rfc2388#section-4.41.exe, 00000002.00000003.3058347091.0000017A3B6AE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053783116.0000017A3B6AD000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.apache.org/licenses/LICENSE-2.01.exe, 00000000.00000003.2046478664.00000252636D3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2046396219.00000252636D3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000000.00000003.2046396219.00000252636C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base641.exe, 00000002.00000003.3037056352.0000017A3A4FD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044385211.0000017A3A537000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041276011.0000017A3A536000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039609311.0000017A3A500000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039874939.0000017A3A52F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058622125.0000017A3A549000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046082292.0000017A3A537000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://weibo.com/1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://github.com/pypa/setuptools1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://repository.swisssign.com/Cd1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.microsoftPGRAD~1.JSOy.z1.exe, 00000002.00000003.3057024319.0000017A3BCEC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://pypi.org/project/setuptools1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://github.com/pypa/setuptools/workflows/tests/badge.svg1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.msn.com1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://nuget.org/nuget.exepowershell.exe, 0000001B.00000002.2298150124.000001CE3F072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2284479122.000001CE30795000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2298150124.000001CE3EF3B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://blog.jaraco.com/skeleton1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://tools.ietf.org/html/rfc36101.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://crl.dhimyotis.com/certignarootca.crl1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043762058.0000017A3BB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://ocsp.accv.es1.exe, 00000002.00000003.3052626504.0000017A387A8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051508240.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042600296.0000017A38790000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041937878.0000017A38778000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://www.reddit.com/1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://packages.debian.org/sid/iputils-arping1.exe, 00000002.00000003.3060113758.0000017A3BD48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2191949277.0000017A3BD47000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000001B.00000002.2284479122.000001CE2EEC1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://www.amazon.ca/1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://github.com/python/cpython/issues/863i1.exe, 00000002.00000003.3037789521.0000017A3A657000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2064902810.0000017A3A64D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2065830974.0000017A3A606000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067085289.0000017A3A606000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2066280806.0000017A3A606000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://discordverify.tech/webhooks/hyzen_exod/1.exe, 00000002.00000003.3058929431.0000017A3BC78000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://docs.python.org/3/library/pprint.html1.exe, 00000002.00000003.3041310003.0000017A3A66B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3062686164.0000017A3A698000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045575233.0000017A3A698000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037789521.0000017A3A657000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051864023.0000017A3A698000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042279402.0000017A3A697000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040522447.0000017A3A658000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040851429.0000017A3A668000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://github.com/pypa/setuptools/actions?query=workflow%3A%22tests%221.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://www.ebay.co.uk/1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://httpbin.org/get1.exe, 00000002.00000003.3054243290.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045012618.0000017A3AB36000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3033943293.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047456493.0000017A3BAAD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056719202.0000017A3BAAE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045170741.0000017A3BAA5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042333473.0000017A3BA96000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000001B.00000002.2284479122.000001CE3070E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access1.exe, 00000002.00000003.2066280806.0000017A3A5BA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067027877.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2074696121.0000017A3AB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076775219.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053018848.0000017A3ABAB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2078098059.0000017A3AB50000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068023103.0000017A3ABAF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041046094.0000017A3AB66000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048191712.0000017A3ABAA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2066211223.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2070576133.0000017A3AB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AB50000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068641821.0000017A3ABAF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3057121566.0000017A3ABAF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053109367.0000017A3ABAD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://www.ebay.de/1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000001B.00000002.2284479122.000001CE3070E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://wwww.certigna.fr/autorites/0m1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader1.exe, 00000002.00000003.3041344247.0000017A387B1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060985301.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060791331.0000017A387B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.amazon.com/1.exe, 00000002.00000003.2176480211.0000017A3E3EC000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://github.com/python/cpython/issues/86361.1.exe, 00000002.00000003.3037056352.0000017A3A4FD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3044385211.0000017A3A537000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041276011.0000017A3A536000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2064096224.0000017A3A6CB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039609311.0000017A3A500000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2065358830.0000017A3A523000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2065201994.0000017A3A4EC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2064210655.0000017A3A6D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061014733.0000017A3A54C000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3039874939.0000017A3A52F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058622125.0000017A3A549000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046082292.0000017A3A537000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://contoso.com/Iconpowershell.exe, 0000001B.00000002.2298150124.000001CE3EF3B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://httpbin.org/1.exe, 00000002.00000003.3041120592.0000017A3A752000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://www.apache.org/licenses/1.exe, 00000000.00000003.2046396219.00000252636C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://wwww.certigna.fr/autorites/1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3052032179.0000017A3BBDC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043146851.0000017A3BBB8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047805687.0000017A3BBDB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3052569220.0000017A3BBDD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://codecov.io/gh/pypa/setuptools1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://www.cl.cam.ac.uk/~mgk25/iso-time.html1.exe, 00000002.00000003.2067027877.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068286975.0000017A3ABB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067027877.0000017A3AB48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068023103.0000017A3ABAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://github.com/python/cpython/issues/8631.exe, 00000002.00000003.3040522447.0000017A3A658000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061936176.0000017A3A65B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br1.exe, 00000002.00000003.2168838863.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2145787875.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192175449.0000017A3CE59000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3054548134.0000017A3CE5B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://www.youtube.com/1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://allegro.pl/1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://github.com/Pester/Pesterpowershell.exe, 0000001B.00000002.2284479122.000001CE3070E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l5351.exe, 00000002.00000003.3037300715.0000017A3BA31000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042759887.0000017A3BA37000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://cryptography.io/en/latest/installation/1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy1.exe, 00000002.00000003.3041344247.0000017A387B1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060985301.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2060791331.0000017A387B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://repository.swisssign.com/en1.exe, 00000002.00000003.3054243290.0000017A3B776000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3033943293.0000017A3B776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                          		unknown
                                                                                                                                          https://MD8.mozilla.org/1/m1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://brew.sh1.exe, 00000002.00000003.2140790853.0000017A3CCED000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056117482.0000017A3BCBF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053446059.0000017A3BCBF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://docs.python.org/3/library/multiprocessing.html1.exe, 00000002.00000003.2066280806.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068345390.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2076996776.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2066065840.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2075124048.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034959002.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2080508443.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3040956293.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3045780862.0000017A3A726000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067085289.0000017A3A726000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://docs.python.org/3/library/re.html1.exe, 00000002.00000003.2076513899.0000017A3AD11000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://www.bbc.co.uk/1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://wiki.debian.org/XDGBaseDirectorySpecification#state1.exe, 00000002.00000003.3042251531.0000017A3A4B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041698267.0000017A3A4AD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037833269.0000017A3A4A8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058185360.0000017A3A4B9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3046206555.0000017A3A4B5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://wwwsearch.sf.net/):1.exe, 00000002.00000003.3040787963.0000017A3A5B5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://bugzilla.mo1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3054778444.0000017A3CDF3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2194817044.0000017A3CDF3000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3033363208.0000017A3CDF3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt01.exe, 00000002.00000003.3052626504.0000017A387A8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051508240.0000017A38798000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051462731.0000017A3AB19000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042600296.0000017A38790000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3041937878.0000017A38778000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://www.accv.es/legislacion_c.htm1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043762058.0000017A3BB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://cryptography.io/en/latest/security/1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://crl.xrampsecurity.com/XGCA.crl01.exe, 00000002.00000003.3045170741.0000017A3BAA5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042333473.0000017A3BA96000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL1.exe, 00000002.00000003.2165342258.0000017A3CE83000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047233307.0000017A3CD3C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://www.cert.fnmt.es/dpcs/1.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034119233.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043146851.0000017A3BBB8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047805687.0000017A3BBDB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3058449892.0000017A3ADD4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035717266.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3038202220.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047837548.0000017A3BBDF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://boxmatrix.info/wiki/Property:arping1.exe, 00000002.00000003.3060113758.0000017A3BD48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2191949277.0000017A3BD47000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://google.com/mail1.exe, 00000002.00000003.3060055871.0000017A3AAEC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037300715.0000017A3BA31000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3061835558.0000017A3BA32000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://www.accv.es001.exe, 00000002.00000003.3032955332.0000017A3BB80000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3037365734.0000017A3BB86000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043762058.0000017A3BB97000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3042914244.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3051462731.0000017A3AB19000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3036275094.0000017A3AAE8000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3043668790.0000017A3BB88000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py1.exe, 00000002.00000003.2060791331.0000017A387B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm1.exe, 00000002.00000003.2067027877.0000017A3AB87000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068286975.0000017A3ABB1000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2067027877.0000017A3AB48000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2068023103.0000017A3ABAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://www.rfc-editor.org/info/rfc72531.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://www.google.com/1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://github.com/pyca/cryptography/issues1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://www.iqiyi.com/1.exe, 00000002.00000003.2176480211.0000017A3E35C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://readthedocs.org/projects/cryptography/badge/?version=latest1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.1.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3059885909.0000017A3B85B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://packaging.python.org/installing/1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              http://google.com/1.exe, 00000002.00000003.3042660136.0000017A3ADEF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3034119233.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3053077672.0000017A3AE11000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3035717266.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3038202220.0000017A3ADCF000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3048315405.0000017A3ADFD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3047326892.0000017A3ADF5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3050933300.0000017A3ADFE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.3056684147.0000017A3AE13000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://mahler:8092/site-updates.py1.exe, 00000002.00000003.3054041207.0000017A3BA90000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  http://tools.ietf.org/html/rfc58691.exe, 00000002.00000003.3055639190.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2140689222.0000017A3B833000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2192359839.0000017A3B840000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2165760063.0000017A3B841000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2169324166.0000017A3B841000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://github.com/psf/black1.exe, 00000000.00000003.2053462914.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://github.com/pyca/cryptography1.exe, 00000000.00000003.2045586111.00000252636C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        https://www.python.org/download/releases/2.3/mro/.1.exe, 00000002.00000003.2059927991.0000017A3A513000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2059853909.0000017A3A4FB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000002.00000003.2059853909.0000017A3A50E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		high

                                                                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                                                                          • No. of IPs < 25%
                                                                                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                                                                                          • 75% < No. of IPs

                                                                                                                                                                                                          Public IPs

                                                                                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                          208.95.112.1
                                                                                                                                                                                                          		ip-api.comUnited States
                                                                                                                                                                                                          		53334TUT-ASUSfalse
                                                                                                                                                                                                          144.76.136.153
                                                                                                                                                                                                          		transfer.shGermany
                                                                                                                                                                                                          		24940HETZNER-ASDEfalse
                                                                                                                                                                                                          18.66.112.128
                                                                                                                                                                                                          		tiktok.comUnited States
                                                                                                                                                                                                          		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                                          34.117.59.81
                                                                                                                                                                                                          		ipinfo.ioUnited States
                                                                                                                                                                                                          		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                                          45.112.123.126
                                                                                                                                                                                                          		api.gofile.ioSingapore
                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                          151.80.152.246
                                                                                                                                                                                                          		idefasoft.frItaly
                                                                                                                                                                                                          		16276OVHFRfalse

                                                                                                                                                                                                          General Information

                                                                                                                                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                          Analysis ID:1585170
                                                                                                                                                                                                          Start date and time:2025-01-07 08:57:11 +01:00
                                                                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                                                                          Overall analysis duration:0h 9m 41s
                                                                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                                                                          Report type:full
                                                                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                          Run name:Run with higher sleep bypass
                                                                                                                                                                                                          Number of analysed new started processes analysed:42
                                                                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                                                                          Number of injected processes analysed:0
                                                                                                                                                                                                          Technologies:
                                                                                                                                                                                                          • HCA enabled
                                                                                                                                                                                                          • EGA enabled
                                                                                                                                                                                                          • AMSI enabled
                                                                                                                                                                                                          Analysis Mode:default
                                                                                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                                                                                          Sample name:1.exe
                                                                                                                                                                                                          Detection:MAL
                                                                                                                                                                                                          Classification:mal96.spyw.evad.winEXE@61/210@6/6
                                                                                                                                                                                                          EGA Information:
                                                                                                                                                                                                          • Successful, ratio: 33.3%
                                                                                                                                                                                                          HCA Information:
                                                                                                                                                                                                          • Successful, ratio: 99%
                                                                                                                                                                                                          • Number of executed functions: 42
                                                                                                                                                                                                          • Number of non-executed functions: 68
                                                                                                                                                                                                          Cookbook Comments:
                                                                                                                                                                                                          • Found application associated with file extension: .exe
                                                                                                                                                                                                          • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                                                                                                                          • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored
                                                                                                                                                                                                          • Stop behavior analysis, all processes terminated

                                                                                                                                                                                                          Warnings

                                                                                                                                                                                                          • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                                          • Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
                                                                                                                                                                                                          • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                          • Execution Graph export aborted for target powershell.exe, PID 5584 because it is empty
                                                                                                                                                                                                          • Execution Graph export aborted for target powershell.exe, PID 6160 because it is empty
                                                                                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                                                                                                                                          Simulations

                                                                                                                                                                                                          Behavior and APIs

                                                                                                                                                                                                          ⊘No simulations

                                                                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                                                                          IPs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          208.95.112.1YPzNsfg4nR.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                          SAL987656700.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                          • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                          Resource.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • ip-api.com/json/?fields=225545
                                                                                                                                                                                                          P3A946MOFP.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                          BootstrapperV1.16.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                          SharkHack.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • ip-api.com/line/?fields=hosting
                                                                                                                                                                                                          paint.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • ip-api.com/json/?fields=225545
                                                                                                                                                                                                          X9g8L63QGs.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • ip-api.com/json/?fields=225545
                                                                                                                                                                                                          KpHYfxnJs6.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • ip-api.com/json/?fields=225545

                                                                                                                                                                                                          Domains

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          ipinfo.ioDownloadedMessage.zipGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 34.117.59.81
                                                                                                                                                                                                          Pralevia Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 34.117.59.81
                                                                                                                                                                                                          Pralevia Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 34.117.59.81
                                                                                                                                                                                                          eP6sjvTqJa.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                          • 34.117.59.81
                                                                                                                                                                                                          YGk3y6Tdix.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                          • 34.117.59.81
                                                                                                                                                                                                          Etqq32Yuw4.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                                                                                                                                          • 34.117.59.81
                                                                                                                                                                                                          file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                          • 34.117.59.81
                                                                                                                                                                                                          file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, XmrigBrowse
                                                                                                                                                                                                          • 34.117.59.81
                                                                                                                                                                                                          file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, XmrigBrowse
                                                                                                                                                                                                          • 34.117.59.81
                                                                                                                                                                                                          ip-api.comYPzNsfg4nR.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          SAL987656700.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          Resource.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          P3A946MOFP.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          BootstrapperV1.16.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          SharkHack.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          paint.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          X9g8L63QGs.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          KpHYfxnJs6.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • 208.95.112.1

                                                                                                                                                                                                          ASNs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          MIT-GATEWAYSUSmiori.x86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 18.43.155.129
                                                                                                                                                                                                          https://u896278.ct.sendgrid.net/ls/click?upn=u001.qpi-2F0q-2FpcJZ7AGoG9N-2BrxLxoGn8scq-2BedBfmGHFAiwRCk-2Fciku7nsS3YfQMNNJI09mLo_nYx4-2F6dkZkjW10KMIp5mXhxys1ng1sBiI-2Bi9ROMYt6d5xhIh5rIqEUIaIxVHh8-2Ftz-2FouCgfXZk6mMUe2uKm92SOgBLlBdhjnRJuhENZnIuGoEoPqnROi7OCzdabJBBnGjEwd2iK-2BngR2RyIIgM3XrJQ7wQhHrfqScifSW3iAsv3H5nGFK9ntcSdChvkxj0yXdE-2FQ0ICDszl57i6aZSB-2Fow-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 18.66.102.79
                                                                                                                                                                                                          https://report-scam.malwarebouncer.com/XcUR2TnV2VTlXT0s0Z0NYa01KSGt3dUtWMWNiblBrc29mMlpZUU1WdThBSjdDdTlRQTVDV1ZZd0pDeWRmUU5rQ1QvVDNiSlBNYWd2bTd0eTRkZW5jT0hrYTBKWHFiVUc4TVZBOGpiNkh4VG9OTm9zNTVUWHNmNWVydHpqbzhIc1llSzdzTHZ0dENVNWRLZy9BbCsyVDRMSGRHOThUWnV5QUxPU0RZL1dPalNYTmUzMTVoRzl5bmk1ZVZRPT0tLUdVYnJkMC9GazI3MWlxYmotLUpFOURyOWkzK1l6Vy9BYTVOVDBVNkE9PQ==?cid=2346401253Get hashmaliciousKnowBe4Browse
                                                                                                                                                                                                          • 18.173.205.50
                                                                                                                                                                                                          sh4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 19.44.195.99
                                                                                                                                                                                                          arm4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 19.240.78.71
                                                                                                                                                                                                          ppc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 18.66.1.18
                                                                                                                                                                                                          w3245.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 18.173.219.113
                                                                                                                                                                                                          https://app.saner.ai/shared/notes/7353e5ae-dd5f-410b-92c3-210c9e88052aGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 18.66.102.51
                                                                                                                                                                                                          https://u43161309.ct.sendgrid.net/ls/click?upn=u001.L9-2FCbhkaoUACh7As3yZ8i4iABGphfl-2FJgS6Xiu1aw6I-3DgXpA_qO4VbBWAKg4gLfGs-2BfuSyZki3gKzG4I1DrYN15Q8fD7JV1twLeLo1AFs1GBSG3ZgA22dFJdXJloKc56aXDeV3olJKTBJd8NprednZ2LeXdX-2BkcSQE-2F2FRwgBng5RbUCLfjS8-2FI3mrpwyYu9lRatIB62qUwPSax-2Fhh2c7R-2B7pT3Kos0wK0SEJGj4ZMkgOGYhEniKYT7Kn7jN25xFz2sFdtPlVQkIdCFKwDNWmq-2BrAxerZE2GuKgfkuf3l1UY4J42sOOltybAAVyLhV-2BXfmbuQpN4NpshXRIuhta8ho3ChcTA5NtgjludQThyLtwhGns-2ByLqSbpO1Bhhc-2FCgdgP-2BAOxYrGHvKHjVYRr6-2BiryADxfM-3DGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 18.66.102.51
                                                                                                                                                                                                          HETZNER-ASDEmiori.x86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 144.79.65.29
                                                                                                                                                                                                          sfqbr.ps1Get hashmaliciousDcRat, KeyLogger, StormKitty, Strela Stealer, VenomRATBrowse
                                                                                                                                                                                                          • 94.130.22.61
                                                                                                                                                                                                          http://yamjoop.siteGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 116.203.80.157
                                                                                                                                                                                                          ZipThis.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 5.161.105.73
                                                                                                                                                                                                          https://tfeweb.co.uk/signoffGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 144.76.9.200
                                                                                                                                                                                                          rHP_SCAN_DOCUME.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 136.243.225.5
                                                                                                                                                                                                          https://sendbot.me/mousse-w0fysl7Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 88.198.57.50
                                                                                                                                                                                                          http://www.housepricesintheuk.co.ukGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 178.63.241.79
                                                                                                                                                                                                          getscreen-524501439-x86.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 78.47.165.25
                                                                                                                                                                                                          TUT-ASUSYPzNsfg4nR.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          SAL987656700.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          Resource.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          P3A946MOFP.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          BootstrapperV1.16.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          SharkHack.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          paint.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          X9g8L63QGs.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • 208.95.112.1
                                                                                                                                                                                                          KpHYfxnJs6.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                          • 208.95.112.1

                                                                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                          Dropped Files

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_ARC4.pydvj0Vxt8xM4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            vj0Vxt8xM4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              snmpapi.exeGet hashmaliciousBraodoBrowse
                                                                                                                                                                                                                snmpapi.exeGet hashmaliciousBraodoBrowse
                                                                                                                                                                                                                  54Oa5PcvK1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    LmZVhGD5jF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      zW72x5d91l.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        7EznMik8Fw.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                          MkWMm5piE5.exeGet hashmaliciousPython StealerBrowse

                                                                                                                                                                                                                            Created / dropped Files

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):64
                                                                                                                                                                                                                            Entropy (8bit):0.34726597513537405
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:Nlll:Nll
                                                                                                                                                                                                                            MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                                                                            SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                                                                            SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                                                                            SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:@...e...........................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk.zip

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:Zip archive data, at least v6.3 to extract, compression method=AES Encrypted
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):479520
                                                                                                                                                                                                                            Entropy (8bit):7.999416306001282
                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                            SSDEEP:12288:2EiLL08Y8sCUzL8q3EMcgZKNkBGAE0KP7Wpr29r:2X/yCUzQq3EM3ZKNTAyPipi1
                                                                                                                                                                                                                            MD5:0F9D684CAD433B5C27475CAA9EB465B9
                                                                                                                                                                                                                            SHA1:8EDFA1EEEAB65FFFCF09A51D7E33797F00C2235B
                                                                                                                                                                                                                            SHA-256:DFFDB67E254653A3D6EB0CB32946575A32115A71B03CFE8CE4B1F49C058EA93D
                                                                                                                                                                                                                            SHA-512:10BB69DBC733B3EE3E90113D269F18D57EA11FD37875453E593B3BC5C0D2010184756A80B2B5781735AC2D2EE71E73265FEE800855A4C70947DD522AFE41B171
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:PK..?...c.Y.'Z.fs~............KRCrnheJsk/Data.txt......AE...%.+La.'..pV=l.,@./....QL..y.Y....+7.O...q....C.K.7..oW..eCY.-.UN........%.c]s.&....C.....2i..-.0.~.eI.`..O.O...q..nr.];.".+.8..`...Q.24..4]_.g1.(....p.I.....f.......HZ.|1O69%..D.SR...TP.d.vd;E....rfR<.^....[..U.a.....*...t..{`.'/P.i#PK..?...c.Y.'ZPU..f...l.......KRCrnheJsk/Errors.txt......AE...AQl....W}.eh.....Ic(.a_..=..ZFf.v.V..CY..8@o.J...1..s....p.2.H..".<.bS.?..O.d...*..jo..U....U.6y.H.*.7.&..?.....,..h..h..5n..*.^.H.....9.|."[[.n.....@......>4.8...2.e.a#....H....Yi@."dZm.Kl.H...;<.*u3f<=.BC3.Z.i........f..-.B;......3....1._. ..p...^V..zu.00>..Rf.p....#....#...k..h....O==.-r..D"..Dq/S.30.E...C................_q9...U:e.....!W}.p.,O..$N......>r.6Y.i.!.G+...........HX...3]d.?.m [.B.._.....}.~.....SdR..q..R...X.........en..H.I...&[.Udz........z...u'.N...o..m..>.!.[.SW....(Rr...""$....g....:C7.....Y.@#.xeQ.Z..4...........iL..'.;1tCT.].S8...~.O'Bw\P.q......6.B...|h.....[..D.'

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\Data.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):513
                                                                                                                                                                                                                            Entropy (8bit):4.6824685759384
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6:WPcZvMarjCvIhJfvLGM67Rb6M4sMwGxtJIW:WkZUACvWJr8z4sk5r
                                                                                                                                                                                                                            MD5:72B40C085D55BB212022A159B15F98ED
                                                                                                                                                                                                                            SHA1:DD3F7D8BBB8FA3C2770CAA81EF5BD45779F012E4
                                                                                                                                                                                                                            SHA-256:4AD85EC5F17DA61574629E94B221CE6D85FF63F4599464C7F43A68FC2E3C461E
                                                                                                                                                                                                                            SHA-512:952F14E72E502CB9CC713D3A740D210635E2C56BAB3AFA9DC91A7E5AE57875DFC6B266A3F4BF05C637157C41A547E673347AB7FBC2CC7D26F7D51AFC8DF0ECB6
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.. KRCrnheJsk..... .. Browsers..... .. Data.txt..... .. Directories... ... .. Desktop.txt... ... .. Documents.txt... ... .. Downloads.txt... ... .. Music.txt... ... .. Pictures.txt... ... .. Videos.txt..... .. Errors.txt..... .. System.. ... .. Antivirus.txt.. ... .. Applications.txt.. ... .. screenshot.png.. ... .. Tasklist.txt..3 directories, 12 files

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\Directories\Desktop.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1592
                                                                                                                                                                                                                            Entropy (8bit):5.128803677165856
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24:RXk39J2hKg/rkiHdbvR5iP4k5wcC5MVVMvRyk0JOJPbC:e3mhKmkUbZ5iP4k5wcC5OiZyGTC
                                                                                                                                                                                                                            MD5:8F2B1410872CE7F3117D844ACA5B5937
                                                                                                                                                                                                                            SHA1:1C29C5119231AB2905E58825B1557AEF2868BC33
                                                                                                                                                                                                                            SHA-256:C909F23B329683215CAF83FBFB60EA2EF4CF94591E08425DFFDD82789A7233E3
                                                                                                                                                                                                                            SHA-512:14E54453375CC667A70943338DA19B04191CE95CBDD22982585B99BEB49669A5388C1E3ED514A6666BEFB83146C28BD92D9D79730CFE264C6E4C8D6D5C8B24CA
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.. Desktop..... .. 1.exe..... .. BJZFPPWAPT.png..... .. desktop.ini..... .. DUUDTUBZFW..... .. EEGWXUHVUG... ... .. BJZFPPWAPT.png... ... .. EEGWXUHVUG.docx... ... .. EFOYFBOLXA.pdf... ... .. GRXZDKKVDB.jpg... ... .. NVWZAPQSQL.xlsx... ... .. PALRGUCVEH.mp3..... .. EEGWXUHVUG.docx..... .. EFOYFBOLXA... ... .. EFOYFBOLXA.docx... ... .. GIGIYTFFYT.jpg... ... .. JDDHMPCDUJ.png... ... .. PALRGUCVEH.xlsx... ... .. ZGGKNSUKOP.pdf... ... .. ZIPXYXWIOY.mp3..... .. EFOYFBOLXA.docx..... .. EFOYFBOLXA.pdf..... .. EIVQSAOTAQ.png..... .. EOWRVPQCCS..... .. EOWRVPQCCS.jpg..... .. Excel.lnk..... .. GIGIYTFFYT.jpg..... .. GIGIYTFFYT.mp3..... .. GLTYDMDUST..... .. GRXZDKKVDB.jpg..... .. GRXZDKKVDB.xlsx..... ..

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\Directories\Documents.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1877
                                                                                                                                                                                                                            Entropy (8bit):5.138896783626401
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:48:y3mhKmkUbZ5wk5wcC5p3r3M3O3q3yiZyC4:ABn+ngbD+0Y5c
                                                                                                                                                                                                                            MD5:2C30967E7A59286940617A5197D3356B
                                                                                                                                                                                                                            SHA1:949A9AD74943591302BBF97C00313C94223791EB
                                                                                                                                                                                                                            SHA-256:D7340531B48C140262E12769E4E9B3EE3A75FC2BB6E6B00A8E5936FAC2459784
                                                                                                                                                                                                                            SHA-512:8C48627E21FC612203DB2C0E8F63435C25E4100EC23BC0B5306BDFEB8E7944FD6AC875C0B22FC6FA48FA38E60A73973A958177ADE9078B97940AB329FBC0E44B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.. Documents..... .. BJZFPPWAPT.png..... .. desktop.ini..... .. DUUDTUBZFW..... .. EEGWXUHVUG... ... .. BJZFPPWAPT.png... ... .. EEGWXUHVUG.docx... ... .. EFOYFBOLXA.pdf... ... .. GRXZDKKVDB.jpg... ... .. NVWZAPQSQL.xlsx... ... .. PALRGUCVEH.mp3..... .. EEGWXUHVUG.docx..... .. EFOYFBOLXA... ... .. EFOYFBOLXA.docx... ... .. GIGIYTFFYT.jpg... ... .. JDDHMPCDUJ.png... ... .. PALRGUCVEH.xlsx... ... .. ZGGKNSUKOP.pdf... ... .. ZIPXYXWIOY.mp3..... .. EFOYFBOLXA.docx..... .. EFOYFBOLXA.pdf..... .. EIVQSAOTAQ.png..... .. EOWRVPQCCS..... .. EOWRVPQCCS.jpg..... .. GIGIYTFFYT.jpg..... .. GIGIYTFFYT.mp3..... .. GLTYDMDUST..... .. GRXZDKKVDB.jpg..... .. GRXZDKKVDB.xlsx..... .. JDDHMPCDUJ.png..... .. LIJDSFKJZG...

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\Directories\Downloads.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):631
                                                                                                                                                                                                                            Entropy (8bit):5.291514322610877
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12:YBRTLK3tc2h7norvHx5wQx5wUx5BOx+CdgiBHiozO5OBa4:n35hOvR5wk5wo5M+0JOp4
                                                                                                                                                                                                                            MD5:0D2BBA810D2B5A0E2D148F9C15A71EB1
                                                                                                                                                                                                                            SHA1:DE4DBAC2E4C9799359EE171579B6EFC75DFD83C8
                                                                                                                                                                                                                            SHA-256:3EB57ED8F8AA8CF4EABEDCC9DC529BEF07D7FE56A928F7082E330596FDF87079
                                                                                                                                                                                                                            SHA-512:BA70BAE8AAC6830160751BCF8039CC87F39046CDA91BCEDCBC4B01E956E8928B6D12A0DA7EFE1EB79D7041012A2994CB1912353FF3CB34B4E704BE97DC5C00D1
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.. Downloads..... .. BJZFPPWAPT.png..... .. desktop.ini..... .. EEGWXUHVUG.docx..... .. EFOYFBOLXA.docx..... .. EFOYFBOLXA.pdf..... .. EIVQSAOTAQ.png..... .. EOWRVPQCCS.jpg..... .. GIGIYTFFYT.jpg..... .. GIGIYTFFYT.mp3..... .. GRXZDKKVDB.jpg..... .. GRXZDKKVDB.xlsx..... .. JDDHMPCDUJ.png..... .. NVWZAPQSQL.docx..... .. NVWZAPQSQL.xlsx..... .. PALRGUCVEH.mp3..... .. PALRGUCVEH.pdf..... .. PALRGUCVEH.xlsx..... .. ZGGKNSUKOP.pdf..... .. ZIPXYXWIOY.mp3..0 directories, 19 files

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\Directories\Music.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):62
                                                                                                                                                                                                                            Entropy (8bit):4.635253769889823
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:j2BvFMKVLKfHGSWLcQJAWn:czLKfHGJhzn
                                                                                                                                                                                                                            MD5:F107B808B2E7C55E5008BAB67244757F
                                                                                                                                                                                                                            SHA1:D7C0258B99BEC149DCECF5507ECC869ABBF357E0
                                                                                                                                                                                                                            SHA-256:B4CD998A662F9DFE027FF44451A450B30E46EAFE272371438E8B7471A4A0D8AF
                                                                                                                                                                                                                            SHA-512:5471C7F1538982AFCBD0FD4F61AB1E732D1C15B937E423A00D708ADE2A8038F9339967B1EC92328E44DFED068529A9835CE54E9EFE65E60C04E385A675AD1B97
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.. Music..... .. desktop.ini..0 directories, 1 files

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\Directories\Pictures.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):190
                                                                                                                                                                                                                            Entropy (8bit):4.677340340590718
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:j1GbT57EIVqUdxHjDFMKVLK3F5MKVLK3pFrEwH5/HjDFMKVLKItSWLCD0n:Rg/VqUXLK39LK3ZFLKItJA0n
                                                                                                                                                                                                                            MD5:792AF172414F1B170389E233E78D417A
                                                                                                                                                                                                                            SHA1:81554A6E3F9729E155A85608C839BF413A16087C
                                                                                                                                                                                                                            SHA-256:456F70E6C843A1C8A9255CF299EE6E10D2B1321E410B43F1243308F9942E6C7B
                                                                                                                                                                                                                            SHA-512:FE66F8EF6AAA8B53E61AAA4C1B817F244766D440C9B30B566BB0829A096C3EB7357A03DC513795354C97193903C48253BA56D23E7B5019968F5DE0834C47B5BC
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.. Pictures..... .. Camera Roll... ... .. desktop.ini..... .. desktop.ini..... .. Saved Pictures.. ... .. desktop.ini..2 directories, 3 files

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\Directories\Videos.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):63
                                                                                                                                                                                                                            Entropy (8bit):4.566266383982755
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:jpvWUfFMKVLKfHGSWLcQJAWn:JzLKfHGJhzn
                                                                                                                                                                                                                            MD5:D13AE2C4D9B07B177B9E37AA08524491
                                                                                                                                                                                                                            SHA1:3B851A1EFEE0912A9D76FE3D9AA7DC1DEB457055
                                                                                                                                                                                                                            SHA-256:D6B7B4FF5334036BBDDBA2C76B1602ABE3BA0D40244886F39D3F7AF1EE16D34B
                                                                                                                                                                                                                            SHA-512:C9FE282DB71DC69E31ED72F6BDFA7D6894CE49174F56D78DD02A43715F9960C434D94CED3AE9ED8312D4007C28745E0D7F6BC809928F2BB48501D9B3E6C60710
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.. Videos..... .. desktop.ini..0 directories, 1 files

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\Errors.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):2924
                                                                                                                                                                                                                            Entropy (8bit):5.163708231672506
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:48:beusO87Etb4XFPnY6pnYXVO9HBtrKkBspA+DoaHBtc:bFBCgb4XnpiOVKkBJ+Dod
                                                                                                                                                                                                                            MD5:A3BFC1FEA9585221258CF30EF5309066
                                                                                                                                                                                                                            SHA1:8DC09E6A5B58B12C4D73CC07DF50B425D99966C7
                                                                                                                                                                                                                            SHA-256:2971F6EF27D94ED24592802E12B18808EC09D616524C0818BD1B5FD16A2D0196
                                                                                                                                                                                                                            SHA-512:AECA51BDE47A519D51B19E04B375CA087F45AA733019385A1E2C2902DF3085ABBB1DB04AE59C72602626E3DFC1360F223C4249E4A087043084B50D4408C35747
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:....==================================================....Traceback (most recent call last):.. File "utils.py", line 22, in new_func.. File "main.py", line 195, in steal_browser_data.. File "browsers.py", line 267, in write_files..FileNotFoundError: [Errno 2] No such file or directory: 'C:\\Users\\user\\AppData\\Local\\Temp\\KRCrnheJsk\\Browsers\\Chrome\\cookies.json'......==================================================....Traceback (most recent call last):.. File "urllib3\connectionpool.py", line 466, in _make_request.. File "urllib3\connectionpool.py", line 1095, in _validate_conn.. File "urllib3\connection.py", line 652, in connect.. File "urllib3\connection.py", line 805, in _ssl_wrap_socket_and_match_hostname.. File "urllib3\util\ssl_.py", line 465, in ssl_wrap_socket.. File "urllib3\util\ssl_.py", line 509, in _ssl_wrap_socket_impl.. File "ssl.py", line 517, in wrap_socket.. File "ssl.py", line 1108, in _create.. File "ssl.py", line 1379, in do_handshake..ssl.SSL

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\System\Antivirus.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                            Entropy (8bit):3.452819531114783
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:jBJiA7X:jBJiA7X
                                                                                                                                                                                                                            MD5:01DAEFE4CAF17BE6854E1A9A0DECE70C
                                                                                                                                                                                                                            SHA1:FEE51C1AB6684F18E59F3FFA9C0296ED1E5DBD28
                                                                                                                                                                                                                            SHA-256:2331BE85A81C008DEDBFEF3BFB0D68EF76AC6BEE37CF9E653591790A21DBBF32
                                                                                                                                                                                                                            SHA-512:AA934777ECB3097CD820EDED81C9C7BAF68039A7E448CEC067317565427212882301BA517ADFB5F63A6677E7D80BAF15837F05DC8C9A9D2BD80F3CA65234ED16
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:Windows Defender

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\System\Applications.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):876
                                                                                                                                                                                                                            Entropy (8bit):5.214747658359754
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24:7o2WfotgAeJpA4VrPUNU27PUCdd2lbPUups2liJ79g:7o2W4reJ+MPY3PxdsbPhpJiJ79g
                                                                                                                                                                                                                            MD5:C6F3A03FD0CF544CB56F593D34D12A66
                                                                                                                                                                                                                            SHA1:3A7BEE3BCE08758426823F22E4EACF7CC113A71E
                                                                                                                                                                                                                            SHA-256:BC1C1C302D51F9BA5279EB9DC9F820DDFA89872745387972EDE7E91B6B4FCABF
                                                                                                                                                                                                                            SHA-512:A093D3DCD04181561610CEDC8FACB10A7DC9AC810AD65217D9B4534E9A20DBC0F224AB790576414DF2C87FC5F38EF257BF3CB365F1124DB65DE062F380A0EF67
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:7-Zip 23.01 (x64) (23.01)..Adobe Acrobat (64-bit) (23.006.20320)..Google Chrome (117.0.5938.132)..Java 8 Update 381 (8.0.3810.9)..Java Auto Updater (2.8.381.9)..Microsoft Edge (117.0.2045.47)..Microsoft Edge Update (1.3.177.11)..Microsoft Edge WebView2 Runtime (117.0.2045.47)..Microsoft Office Professional Plus 2019 - en-us (16.0.16827.20130)..Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)..Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)..Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)..Mozilla Firefox (x64 en-US) (118.0.1)..Mozilla Maintenance Service (118.0.1)..Office 16 Click-to-Run Extensibility Component (16.0.16827.20130)..Office 16 Click-to-Run Extensibility Component 64-bit Registration (16.0.16827.20056)..Office 16 Click-to-Run Licensing Component (16.0.16827.20130)

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\System\Tasklist.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15052
                                                                                                                                                                                                                            Entropy (8bit):3.4035157564189675
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:yQe+esr9rfrFrcr8r1rtXJI6WRCgDy/HyS+Ufo3XBD7AVH7szWTrBk3SN6kAbTBd:yQe+1r9rfrFrcr8r1rtXJI6WRCgDy/H8
                                                                                                                                                                                                                            MD5:020C4C05AA48A3086690F221E45C04D6
                                                                                                                                                                                                                            SHA1:6745C35ED7B6D68A35DAF19C2B45D67663F63E71
                                                                                                                                                                                                                            SHA-256:9B977B74A79CE752E6F419B3F0F377D9CEE57FA53E424370ECB4760CCFC4F31C
                                                                                                                                                                                                                            SHA-512:AF7B3ED166C7FBFE06C0AA7A780E6C98FCE4486F0E018FF541F806DD836949D6133BA786E94472F5189D92519038DE1354DF09F202F7FCE5048818A225FAE542
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:1.exe 6008 Console 1 89'428 K..1.exe 6392 Console 1 6'024 K..========================= ======== ================ =========== ============..ApplicationFrameHost.exe 6040 Console 1 29'348 K..Memory Compression 1584 Services 0 760 K..OfficeClickToRun.exe 2484 Services 0 40'540 K..Registry 92 Services 0 79'040 K..RuntimeBroker.exe 1344 Console 1 7'588 K..RuntimeBroker.exe 4500 Console 1 16'880 K..RuntimeBroker.exe 4732 Console 1 26'464 K..RuntimeBroker.exe 4924 Console 1 14'832 K..RuntimeBroker.exe 4988 Console 1 29'904 K..RuntimeBroker.exe 4996 Console 1

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\KRCrnheJsk\System\screenshot.png

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PNG image data, 1280 x 1024, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):469508
                                                                                                                                                                                                                            Entropy (8bit):7.993939737304066
                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                            SSDEEP:12288:FG0rTzBIpsc8cpcjwDQP1ECbBhPBSiNTrp:FG0rhnHQcqCbBh7L
                                                                                                                                                                                                                            MD5:BAAD783BC0A16DD96730B2389DB8794E
                                                                                                                                                                                                                            SHA1:4F51A55535902FA4426F46B6CD01B7C238A695E1
                                                                                                                                                                                                                            SHA-256:180ECDEB9716EEF3509121106BB54888401363047106B2C15E089A7C5B94A893
                                                                                                                                                                                                                            SHA-512:E45668A5B92D82F0A03B9FCA63C4AEAD8D149B80CF208D7174F504CB670315388FCAABE820DF04690AE24D2B5F7F705A26907BDC7B9099BCC978DA62574933FE
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.PNG........IHDR.............1.c.....IDATx...{.eGU'..U{.s.o'};...Lw...I...&....Ip..&......O...23.s....$.....8./...*...OH:..B..<.tw.......k..X...T...s.}ow.9g..U.V..{}j.Z......gW$..$."3....J^..II.+?-iI...A......r..E.*.jR......]..wM.......k0..s.z.Z..w*9.a..".sd."....U5......Wi.WP.$<...1LvKA.`)Mk..i9q.e.C..;...gM.{-.yq...Cc.f.>.'....|i>[=:.........z..%e.h..M.......U..]f..#......d.k.L$./{.{..^e._..c.{OD.9.>S...^F..sZ.~ff....Hq.....Cf.F.....X.T ..hffFD....;.............^.'"....Cfv.X-3..D\ZmY....{_.......1...+.HzE.:.."R.R.=.. .....`.""....T.*......[k.b..Lz.7]E...T8.....{?...(.sUU.e..T~L..sN.........Ts.e.q.td.....n.f%.B....V.Y.D4........3UQ..h4.....,...#E.....pd.hM.L(...A.UUUUU.$NR.p..N"S'lh4.UU....4.....&F.e..Jf..[s"#U......U.^.,K.vV{.O..YoT..s&+f..I..q...I.4%..t...h.<7E........eHc.yXR....,u.^3....cf.t.;.Y..D8..M8jO..6..A......"l..*...f.Y..9;....!VO..U.P0.GA.r...:}.5..2j.$..A.I..!.CfH/.."`..@.3.......0`#...X...pd.+...&L.I..+....X.q.I.(._.6

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                            Entropy (8bit):4.703513333396807
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:nDzb9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDV90OcX6gY/7ECFV:Dzz9damqTrpYTst0E5DVPcqgY/79X
                                                                                                                                                                                                                            MD5:6176101B7C377A32C01AE3EDB7FD4DE6
                                                                                                                                                                                                                            SHA1:5F1CB443F9D677F313BEC07C5241AEAB57502F5E
                                                                                                                                                                                                                            SHA-256:EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB
                                                                                                                                                                                                                            SHA-512:3E7373B71AE0834E96A99595CFEF2E96C0F5230429ADC0B5512F4089D1ED0D7F7F0E32A40584DFB13C41D257712A9C4E9722366F0A21B907798AE79D8CEDCF30
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                                            • Filename: vj0Vxt8xM4.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: vj0Vxt8xM4.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: snmpapi.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: snmpapi.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: 54Oa5PcvK1.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: LmZVhGD5jF.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: zW72x5d91l.bat, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: 7EznMik8Fw.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: MkWMm5piE5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                            Entropy (8bit):4.968452734961967
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
                                                                                                                                                                                                                            MD5:371776A7E26BAEB3F75C93A8364C9AE0
                                                                                                                                                                                                                            SHA1:BF60B2177171BA1C6B4351E6178529D4B082BDA9
                                                                                                                                                                                                                            SHA-256:15257E96D1CA8480B8CB98F4C79B6E365FE38A1BA9638FC8C9AB7FFEA79C4762
                                                                                                                                                                                                                            SHA-512:C23548FBCD1713C4D8348917FF2AB623C404FB0E9566AB93D147C62E06F51E63BDAA347F2D203FE4F046CE49943B38E3E9FA1433F6455C97379F2BC641AE7CE9
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                            Entropy (8bit):5.061461040216793
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:ldF/1nb2mhQtkXn0t/WS60YYDEiqvdvGyv9lkVcqgYvEMo:v2f6XSZ6XYD6vdvGyv9MgYvEMo
                                                                                                                                                                                                                            MD5:CB5238E2D4149636377F9A1E2AF6DC57
                                                                                                                                                                                                                            SHA1:038253BABC9E652BA4A20116886209E2BCCF35AC
                                                                                                                                                                                                                            SHA-256:A8D3BB9CD6A78EBDB4F18693E68B659080D08CB537F9630D279EC9F26772EFC7
                                                                                                                                                                                                                            SHA-512:B1E6AB509CF1E5ECC6A60455D6900A76514F8DF43F3ABC3B8D36AF59A3DF8A868B489ED0B145D0D799AAC8672CBF5827C503F383D3F38069ABF6056ECCD87B21
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                            Entropy (8bit):5.236167046748013
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:/siHXqpoUol3xZhRyQX5lDnRDFYav+tcqgRvE:h6D+XBDgDgRvE
                                                                                                                                                                                                                            MD5:D9E7218460AEE693BEA07DA7C2B40177
                                                                                                                                                                                                                            SHA1:9264D749748D8C98D35B27BEFE6247DA23FF103D
                                                                                                                                                                                                                            SHA-256:38E423D3BCC32EE6730941B19B7D5D8872C0D30D3DD8F9AAE1442CB052C599AD
                                                                                                                                                                                                                            SHA-512:DDB579E2DEA9D266254C0D9E23038274D9AE33F0756419FD53EC6DC1A27D1540828EE8F4AD421A5CFFD9B805F1A68F26E70BDC1BAB69834E8ACD6D7BB7BDB0DB
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..*...*...*...R...*...U...*..R...*...*...*...U...*...U...*...U...*.....*.....*...}..*.....*..Rich.*..........................PE..d....e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):36352
                                                                                                                                                                                                                            Entropy (8bit):6.558176937399355
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:Dz2P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuCLg46:DzeqWB7YJlmLJ3oD/S4j990th9VCsC
                                                                                                                                                                                                                            MD5:F751792DF10CDEED391D361E82DAF596
                                                                                                                                                                                                                            SHA1:3440738AF3C88A4255506B55A673398838B4CEAC
                                                                                                                                                                                                                            SHA-256:9524D1DADCD2F2B0190C1B8EDE8E5199706F3D6C19D3FB005809ED4FEBF3E8B5
                                                                                                                                                                                                                            SHA-512:6159F245418AB7AD897B02F1AADF1079608E533B9C75006EFAF24717917EAA159846EE5DFC0E85C6CFF8810319EFECBA80C1D51D1F115F00EC1AFF253E312C00
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                                            Entropy (8bit):5.285191078037458
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:wJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4jqccqgwYUMvEW:ikRwi3wO26Ef+yuIm9PfD7wgwYUMvE
                                                                                                                                                                                                                            MD5:BBEA5FFAE18BF0B5679D5C5BCD762D5A
                                                                                                                                                                                                                            SHA1:D7C2721795113370377A1C60E5CEF393473F0CC5
                                                                                                                                                                                                                            SHA-256:1F4288A098DA3AAC2ADD54E83C8C9F2041EC895263F20576417A92E1E5B421C1
                                                                                                                                                                                                                            SHA-512:0932EC5E69696D6DD559C30C19FC5A481BEFA38539013B9541D84499F2B6834A2FFE64A1008A1724E456FF15DDA6268B7B0AD8BA14918E2333567277B3716CC4
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d....e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                                                            Entropy (8bit):5.505471888568532
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:vd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DW3Q2dhmdcqgwNeecBih:JkP5cjIGpKlqD2D4kzgwNeE
                                                                                                                                                                                                                            MD5:D2175300E065347D13211F5BF7581602
                                                                                                                                                                                                                            SHA1:3AE92C0B0ECDA1F6B240096A4E68D16D3DB1FFB0
                                                                                                                                                                                                                            SHA-256:94556934E3F9EE73C77552D2F3FC369C02D62A4C9E7143E472F8E3EE8C00AEE1
                                                                                                                                                                                                                            SHA-512:6156D744800206A431DEE418A1C561FFB45D726DC75467A91D26EE98503B280C6595CDEA02BDA6A023235BD010835EA1FC9CB843E9FEC3501980B47B6B490AF7
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):20992
                                                                                                                                                                                                                            Entropy (8bit):6.06124024160806
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:bUv5cJMOZA0nmwBD+XpJgLa0Mp8Qpg4P2llyM:0K1XBD+DgLa1yTi
                                                                                                                                                                                                                            MD5:45616B10ABE82D5BB18B9C3AB446E113
                                                                                                                                                                                                                            SHA1:91B2C0B0F690AE3ABFD9B0B92A9EA6167049B818
                                                                                                                                                                                                                            SHA-256:F348DB1843B8F38A23AEE09DD52FB50D3771361C0D529C9C9E142A251CC1D1EC
                                                                                                                                                                                                                            SHA-512:ACEA8C1A3A1FA19034FD913C8BE93D5E273B7719D76CB71C36F510042918EA1D9B44AC84D849570F9508D635B4829D3E10C36A461EC63825BA178F5AC1DE85FB
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):25088
                                                                                                                                                                                                                            Entropy (8bit):6.475467273446457
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:oc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy4IYgLWi:B6H1TZXX5XmrXA+NNxWiFdLWi
                                                                                                                                                                                                                            MD5:CF3C2F35C37AA066FA06113839C8A857
                                                                                                                                                                                                                            SHA1:39F3B0AEFB771D871A93681B780DA3BD85A6EDD0
                                                                                                                                                                                                                            SHA-256:1261783F8881642C3466B96FA5879A492EA9E0DAB41284ED9E4A82E8BCF00C80
                                                                                                                                                                                                                            SHA-512:1C36B80AAE49FD5E826E95D83297AE153FDB2BC652A47D853DF31449E99D5C29F42ED82671E2996AF60DCFB862EC5536BB0A68635D4E33D33F8901711C0C8BE6
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                            Entropy (8bit):4.838534302892255
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
                                                                                                                                                                                                                            MD5:20708935FDD89B3EDDEEA27D4D0EA52A
                                                                                                                                                                                                                            SHA1:85A9FE2C7C5D97FD02B47327E431D88A1DC865F7
                                                                                                                                                                                                                            SHA-256:11DD1B49F70DB23617E84E08E709D4A9C86759D911A24EBDDFB91C414CC7F375
                                                                                                                                                                                                                            SHA-512:F28C31B425DC38B5E9AD87B95E8071997E4A6F444608E57867016178CD0CA3E9F73A4B7F2A0A704E45F75B7DCFF54490510C6BF8461F3261F676E9294506D09B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                            Entropy (8bit):4.9047185025862925
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
                                                                                                                                                                                                                            MD5:43BBE5D04460BD5847000804234321A6
                                                                                                                                                                                                                            SHA1:3CAE8C4982BBD73AF26EB8C6413671425828DBB7
                                                                                                                                                                                                                            SHA-256:FAA41385D0DB8D4EE2EE74EE540BC879CF2E884BEE87655FF3C89C8C517EED45
                                                                                                                                                                                                                            SHA-512:DBC60F1D11D63BEBBAB3C742FB827EFBDE6DFF3C563AE1703892D5643D5906751DB3815B97CBFB7DA5FCD306017E4A1CDCC0CDD0E61ADF20E0816F9C88FE2C9B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d....e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                            Entropy (8bit):5.300163691206422
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
                                                                                                                                                                                                                            MD5:C6B20332B4814799E643BADFFD8DF2CD
                                                                                                                                                                                                                            SHA1:E7DA1C1F09F6EC9A84AF0AB0616AFEA55A58E984
                                                                                                                                                                                                                            SHA-256:61C7A532E108F67874EF2E17244358DF19158F6142680F5B21032BA4889AC5D8
                                                                                                                                                                                                                            SHA-512:D50C7F67D2DFB268AD4CF18E16159604B6E8A50EA4F0C9137E26619FD7835FAAD323B5F6A2B8E3EC1C023E0678BCBE5D0F867CD711C5CD405BD207212228B2B4
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..*B..*B..*B..R...*B..UC..*B.RC..*B..*C..*B..UG..*B..UF..*B..UA..*B..J..*B..B..*B....*B..@..*B.Rich.*B.........................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):57856
                                                                                                                                                                                                                            Entropy (8bit):4.260220483695234
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:9XUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZNZY0JAIg+v:99HGHfJidSK
                                                                                                                                                                                                                            MD5:0B538205388FDD99A043EE3AFAA074E4
                                                                                                                                                                                                                            SHA1:E0DD9306F1DBE78F7F45A94834783E7E886EB70F
                                                                                                                                                                                                                            SHA-256:C4769D3E6EB2A2FECB5DEC602D45D3E785C63BB96297268E3ED069CC4A019B1A
                                                                                                                                                                                                                            SHA-512:2F4109E42DB7BC72EB50BCCC21EB200095312EA00763A255A38A4E35A77C04607E1DB7BB69A11E1D80532767B20BAA4860C05F52F32BF1C81FE61A7ECCEB35ED
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):58368
                                                                                                                                                                                                                            Entropy (8bit):4.276870967324261
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:9jUqho9weF5/eHkRnYcZiGKdZHDL7idErZjZYXGg:9RCneH//id42
                                                                                                                                                                                                                            MD5:6C3E976AB9F47825A5BD9F73E8DBA74E
                                                                                                                                                                                                                            SHA1:4C6EB447FE8F195CF7F4B594CE7EAF928F52B23A
                                                                                                                                                                                                                            SHA-256:238CDB6B8FB611DB4626E6D202E125E2C174C8F73AE8A3273B45A0FC18DEA70C
                                                                                                                                                                                                                            SHA-512:B19516F00CC0484D9CDA82A482BBFE41635CDBBE19C13F1E63F033C9A68DD36798C44F04D6BD8BAE6523A845E852D81ACADD0D5DD86AF62CC9D081B803F8DF7B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                            Entropy (8bit):4.578113904149635
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
                                                                                                                                                                                                                            MD5:FEE13D4FB947835DBB62ACA7EAFF44EF
                                                                                                                                                                                                                            SHA1:7CC088AB68F90C563D1FE22D5E3C3F9E414EFC04
                                                                                                                                                                                                                            SHA-256:3E0D07BBF93E0748B42B1C2550F48F0D81597486038C22548224584AE178A543
                                                                                                                                                                                                                            SHA-512:DEA92F935BC710DF6866E89CC6EB5B53FC7ADF0F14F3D381B89D7869590A1B0B1F98F347664F7A19C6078E7AA3EB0F773FFCB711CC4275D0ECD54030D6CF5CB2
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):22016
                                                                                                                                                                                                                            Entropy (8bit):6.143719741413071
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:IUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Q90gYP2lXCM:BKR8I+K0lDFQgLa17zU
                                                                                                                                                                                                                            MD5:76F88D89643B0E622263AF676A65A8B4
                                                                                                                                                                                                                            SHA1:93A365060E98890E06D5C2D61EFBAD12F5D02E06
                                                                                                                                                                                                                            SHA-256:605C86145B3018A5E751C6D61FD0F85CF4A9EBF2AD1F3009A4E68CF9F1A63E49
                                                                                                                                                                                                                            SHA-512:979B97AAC01633C46C048010FA886EBB09CFDB5520E415F698616987AE850FD342A4210A8DC0FAC1E059599F253565862892171403F5E4F83754D02D2EF3F366
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):17920
                                                                                                                                                                                                                            Entropy (8bit):5.353267174592179
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:7PHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8bg6Vf4A:hPcnB8KSsB34cb+bcOYpMCBDX
                                                                                                                                                                                                                            MD5:D48BFFA1AF800F6969CFB356D3F75AA6
                                                                                                                                                                                                                            SHA1:2A0D8968D74EBC879A17045EFE86C7FB5C54AEE6
                                                                                                                                                                                                                            SHA-256:4AA5E9CE7A76B301766D3ECBB06D2E42C2F09D0743605A91BF83069FEFE3A4DE
                                                                                                                                                                                                                            SHA-512:30D14AD8C68B043CC49EAFB460B69E83A15900CB68B4E0CBB379FF5BA260194965EF300EB715308E7211A743FF07FA7F8779E174368DCAA7F704E43068CC4858
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                            Entropy (8bit):4.741247880746506
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
                                                                                                                                                                                                                            MD5:4D9182783EF19411EBD9F1F864A2EF2F
                                                                                                                                                                                                                            SHA1:DDC9F878B88E7B51B5F68A3F99A0857E362B0361
                                                                                                                                                                                                                            SHA-256:C9F4C5FFCDD4F8814F8C07CE532A164AB699AE8CDE737DF02D6ECD7B5DD52DBD
                                                                                                                                                                                                                            SHA-512:8F983984F0594C2CAC447E9D75B86D6EC08ED1C789958AFA835B0D1239FD4D7EBE16408D080E7FCE17C379954609A93FC730B11BE6F4A024E7D13D042B27F185
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                            Entropy (8bit):5.212941287344097
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:2F/1nb2mhQtkRySMfJ2ycxFzShJD9bAal2QDeJKcqgQx2QY:M2fKRQB2j8JD2fJagQx2QY
                                                                                                                                                                                                                            MD5:F4EDB3207E27D5F1ACBBB45AAFCB6D02
                                                                                                                                                                                                                            SHA1:8EAB478CA441B8AD7130881B16E5FAD0B119D3F0
                                                                                                                                                                                                                            SHA-256:3274F49BE39A996C5E5D27376F46A1039B6333665BB88AF1CA6D37550FA27B29
                                                                                                                                                                                                                            SHA-512:7BDEBF9829CB26C010FCE1C69E7580191084BCDA3E2847581D0238AF1CAA87E68D44B052424FDC447434D971BB481047F8F2DA1B1DEF6B18684E79E63C6FBDC5
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                                            Entropy (8bit):5.181291194389683
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
                                                                                                                                                                                                                            MD5:9D28433EA8FFBFE0C2870FEDA025F519
                                                                                                                                                                                                                            SHA1:4CC5CF74114D67934D346BB39CA76F01F7ACC3E2
                                                                                                                                                                                                                            SHA-256:FC296145AE46A11C472F99C5BE317E77C840C2430FBB955CE3F913408A046284
                                                                                                                                                                                                                            SHA-512:66B4D00100D4143EA72A3F603FB193AFA6FD4EFB5A74D0D17A206B5EF825E4CC5AF175F5FB5C40C022BDE676BA7A83087CB95C9F57E701CA4E7F0A2FCE76E599
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                                            Entropy (8bit):5.140195114409974
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:RsiHXqpo0cUp8XnUp8XjEQnlDtJI6rcqgcx2:f6DcUp8XUp8AclDA69gcx2
                                                                                                                                                                                                                            MD5:8A92EE2B0D15FFDCBEB7F275154E9286
                                                                                                                                                                                                                            SHA1:FA9214C8BBF76A00777DFE177398B5F52C3D972D
                                                                                                                                                                                                                            SHA-256:8326AE6AD197B5586222AFA581DF5FE0220A86A875A5E116CB3828E785FBF5C2
                                                                                                                                                                                                                            SHA-512:7BA71C37AAF6CB10FC5C595D957EB2846032543626DE740B50D7CB954FF910DCF7CEAA56EB161BAB9CC1F663BADA6CA71973E6570BAC7D6DA4D4CC9ED7C6C3DA
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                            Entropy (8bit):5.203867759982304
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:WsiHXqpwUiv6wPf+4WVrd1DFrCqwWwcqgfvE:s6biio2Pd1DFmlgfvE
                                                                                                                                                                                                                            MD5:FE16E1D12CF400448E1BE3FCF2D7BB46
                                                                                                                                                                                                                            SHA1:81D9F7A2C6540F17E11EFE3920481919965461BA
                                                                                                                                                                                                                            SHA-256:ADE1735800D9E82B787482CCDB0FBFBA949E1751C2005DCAE43B0C9046FE096F
                                                                                                                                                                                                                            SHA-512:A0463FF822796A6C6FF3ACEBC4C5F7BA28E7A81E06A3C3E46A0882F536D656D3F8BAF6FB748008E27F255FE0F61E85257626010543FC8A45A1E380206E48F07C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                            Entropy (8bit):5.478301937972917
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:hZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZkRsP0rcqgjPrvE:8Q0gH7zSccA5J6ECTGmDua89gjPrvE
                                                                                                                                                                                                                            MD5:34EBB5D4A90B5A39C5E1D87F61AE96CB
                                                                                                                                                                                                                            SHA1:25EE80CC1E647209F658AEBA5841F11F86F23C4E
                                                                                                                                                                                                                            SHA-256:4FC70CB9280E414855DA2C7E0573096404031987C24CF60822854EAA3757C593
                                                                                                                                                                                                                            SHA-512:82E27044FD53A7309ABAECA06C077A43EB075ADF1EF0898609F3D9F42396E0A1FA4FFD5A64D944705BBC1B1EBB8C2055D8A420807693CC5B70E88AB292DF81B7
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):18432
                                                                                                                                                                                                                            Entropy (8bit):5.69608744353984
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:nkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+DSngkov:onx7RI26LuuHKz8+DbN
                                                                                                                                                                                                                            MD5:42C2F4F520BA48779BD9D4B33CD586B9
                                                                                                                                                                                                                            SHA1:9A1D6FFA30DCA5CE6D70EAC5014739E21A99F6D8
                                                                                                                                                                                                                            SHA-256:2C6867E88C5D3A83D62692D24F29624063FCE57F600483BAD6A84684FF22F035
                                                                                                                                                                                                                            SHA-512:1F0C18E1829A5BAE4A40C92BA7F8422D5FE8DBE582F7193ACEC4556B4E0593C898956065F398ACB34014542FCB3365DC6D4DA9CE15CB7C292C8A2F55FB48BB2B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.*... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):19456
                                                                                                                                                                                                                            Entropy (8bit):5.7981108922569735
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
                                                                                                                                                                                                                            MD5:AB0BCB36419EA87D827E770A080364F6
                                                                                                                                                                                                                            SHA1:6D398F48338FB017AACD00AE188606EB9E99E830
                                                                                                                                                                                                                            SHA-256:A927548ABEA335E6BCB4A9EE0A949749C9E4AA8F8AAD481CF63E3AC99B25A725
                                                                                                                                                                                                                            SHA-512:3580FB949ACEE709836C36688457908C43860E68A36D3410F3FA9E17C6A66C1CDD7C081102468E4E92E5F42A0A802470E8F4D376DAA4ED7126818538E0BD0BC4
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):22016
                                                                                                                                                                                                                            Entropy (8bit):5.865452719694432
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:y1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOcwgjxo:QjwyJUYToZwOLuzDNB1j
                                                                                                                                                                                                                            MD5:C8FE3FF9C116DB211361FBB3EA092D33
                                                                                                                                                                                                                            SHA1:180253462DD59C5132FBCCC8428DEA1980720D26
                                                                                                                                                                                                                            SHA-256:25771E53CFECB5462C0D4F05F7CAE6A513A6843DB2D798D6937E39BA4B260765
                                                                                                                                                                                                                            SHA-512:16826BF93C8FA33E0B5A2B088FB8852A2460E0A02D699922A39D8EB2A086E981B5ACA2B085F7A7DA21906017C81F4D196B425978A10F44402C5DB44B2BF4D00A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):22016
                                                                                                                                                                                                                            Entropy (8bit):5.867732744112887
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
                                                                                                                                                                                                                            MD5:A442EA85E6F9627501D947BE3C48A9DD
                                                                                                                                                                                                                            SHA1:D2DEC6E1BE3B221E8D4910546AD84FE7C88A524D
                                                                                                                                                                                                                            SHA-256:3DBCB4D0070BE355E0406E6B6C3E4CE58647F06E8650E1AB056E1D538B52B3D3
                                                                                                                                                                                                                            SHA-512:850A00C7069FFDBA1EFE1324405DA747D7BD3BA5D4E724D08A2450B5A5F15A69A0D3EAF67CEF943F624D52A4E2159A9F7BDAEAFDC6C689EACEA9987414250F3B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27136
                                                                                                                                                                                                                            Entropy (8bit):5.860044313282322
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:xFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDXfgjVx2:jDLh98jjRe+1WT1aAeIfMzxH2mDDIj
                                                                                                                                                                                                                            MD5:59BA0E05BE85F48688316EE4936421EA
                                                                                                                                                                                                                            SHA1:1198893F5916E42143C0B0F85872338E4BE2DA06
                                                                                                                                                                                                                            SHA-256:C181F30332F87FEECBF930538E5BDBCA09089A2833E8A088C3B9F3304B864968
                                                                                                                                                                                                                            SHA-512:D772042D35248D25DB70324476021FB4303EF8A0F61C66E7DED490735A1CC367C2A05D7A4B11A2A68D7C34427971F96FF7658D880E946C31C17008B769E3B12F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27136
                                                                                                                                                                                                                            Entropy (8bit):5.917025846093607
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXwElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXD+j
                                                                                                                                                                                                                            MD5:8194D160FB215498A59F850DC5C9964C
                                                                                                                                                                                                                            SHA1:D255E8CCBCE663EE5CFD3E1C35548D93BFBBFCC0
                                                                                                                                                                                                                            SHA-256:55DEFCD528207D4006D54B656FD4798977BD1AAE6103D4D082A11E0EB6900B08
                                                                                                                                                                                                                            SHA-512:969EEAA754519A58C352C24841852CF0E66C8A1ADBA9A50F6F659DC48C3000627503DDFB7522DA2DA48C301E439892DE9188BF94EEAF1AE211742E48204C5E42
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12800
                                                                                                                                                                                                                            Entropy (8bit):4.999870226643325
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:DzFRF/1nb2mhQtk4axusjfkgZhoYDQgRjcqgQvEty:DzFd2f64axnTTz5D1gQvEty
                                                                                                                                                                                                                            MD5:C89BECC2BECD40934FE78FCC0D74D941
                                                                                                                                                                                                                            SHA1:D04680DF546E2D8A86F60F022544DB181F409C50
                                                                                                                                                                                                                            SHA-256:E5B6E58D6DA8DB36B0673539F0C65C80B071A925D2246C42C54E9FCDD8CA08E3
                                                                                                                                                                                                                            SHA-512:715B3F69933841BAADC1C30D616DB34E6959FD9257D65E31C39CD08C53AFA5653B0E87B41DCC3C5E73E57387A1E7E72C0A668578BD42D5561F4105055F02993C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d....e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                            Entropy (8bit):5.025153056783597
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
                                                                                                                                                                                                                            MD5:C4CC05D3132FDFB05089F42364FC74D2
                                                                                                                                                                                                                            SHA1:DA7A1AE5D93839577BBD25952A1672C831BC4F29
                                                                                                                                                                                                                            SHA-256:8F3D92DE840ABB5A46015A8FF618FF411C73009CBAA448AC268A5C619CF84721
                                                                                                                                                                                                                            SHA-512:C597C70B7AF8E77BEEEBF10C32B34C37F25C741991581D67CF22E0778F262E463C0F64AA37F92FBC4415FE675673F3F92544E109E5032E488F185F1CFBC839FE
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                                                            Entropy (8bit):5.235115741550938
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:XTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDhgvrjcqgCieT3WQ:XafgNpj9cHW3jqXeBRamDOZgCieT
                                                                                                                                                                                                                            MD5:1E201DF4B4C8A8CD9DA1514C6C21D1C4
                                                                                                                                                                                                                            SHA1:3DC8A9C20313AF189A3FFA51A2EAA1599586E1B2
                                                                                                                                                                                                                            SHA-256:A428372185B72C90BE61AC45224133C4AF6AE6682C590B9A3968A757C0ABD6B4
                                                                                                                                                                                                                            SHA-512:19232771D4EE3011938BA2A52FA8C32E00402055038B5EDF3DDB4C8691FA7AE751A1DC16766D777A41981B7C27B14E9C1AD6EBDA7FFE1B390205D0110546EE29
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                            Entropy (8bit):5.133714807569085
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:JZNGXEgvUh43G6coX2SSwmPL4V7wTdDlpaY2cqgWjvE:EVMhuGGF2L4STdDyYWgWjvE
                                                                                                                                                                                                                            MD5:76C84B62982843367C5F5D41B550825F
                                                                                                                                                                                                                            SHA1:B6DE9B9BD0E2C84398EA89365E9F6D744836E03A
                                                                                                                                                                                                                            SHA-256:EBCD946F1C432F93F396498A05BF07CC77EE8A74CE9C1A283BF9E23CA8618A4C
                                                                                                                                                                                                                            SHA-512:03F8BB1D0D63BF26D8A6FFF62E94B85FFB4EA1857EB216A4DEB71C806CDE107BA0F9CC7017E3779489C5CEF5F0838EDB1D70F710BCDEB629364FC288794E6AFE
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):35840
                                                                                                                                                                                                                            Entropy (8bit):5.928082706906375
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:8bEkzS7+k9rMUb8cOe9rs9ja+V/Mhjh56GS:8bEP779rMtcOCs0I/Mhf
                                                                                                                                                                                                                            MD5:B41160CF884B9E846B890E0645730834
                                                                                                                                                                                                                            SHA1:A0F35613839A0F8F4A87506CD59200CCC3C09237
                                                                                                                                                                                                                            SHA-256:48F296CCACE3878DE1148074510BD8D554A120CAFEF2D52C847E05EF7664FFC6
                                                                                                                                                                                                                            SHA-512:F4D57351A627DD379D56C80DA035195292264F49DC94E597AA6638DF5F4CF69601F72CC64FC3C29C5CBE95D72326395C5C6F4938B7895C69A8D839654CFC8F26
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                            Entropy (8bit):4.799063285091512
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
                                                                                                                                                                                                                            MD5:BA46602B59FCF8B01ABB135F1534D618
                                                                                                                                                                                                                            SHA1:EFF5608E05639A17B08DCA5F9317E138BEF347B5
                                                                                                                                                                                                                            SHA-256:B1BAB0E04AC60D1E7917621B03A8C72D1ED1F0251334E9FA12A8A1AC1F516529
                                                                                                                                                                                                                            SHA-512:A5E2771623DA697D8EA2E3212FBDDE4E19B4A12982A689D42B351B244EFBA7EFA158E2ED1A2B5BC426A6F143E7DB810BA5542017AB09B5912B3ECC091F705C6E
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d....e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):754688
                                                                                                                                                                                                                            Entropy (8bit):7.624959985050181
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:I1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h9:gYmzHoxJFf1p34hcrn5Go9yQO6L
                                                                                                                                                                                                                            MD5:3F20627FDED2CF90E366B48EDF031178
                                                                                                                                                                                                                            SHA1:00CED7CD274EFB217975457906625B1B1DA9EBDF
                                                                                                                                                                                                                            SHA-256:E36242855879D71AC57FBD42BB4AE29C6D80B056F57B18CEE0B6B1C0E8D2CF57
                                                                                                                                                                                                                            SHA-512:05DE7C74592B925BB6D37528FC59452C152E0DCFC1D390EA1C48C057403A419E5BE40330B2C5D5657FEA91E05F6B96470DDDF9D84FF05B9FD4192F73D460093C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d....e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27648
                                                                                                                                                                                                                            Entropy (8bit):5.792654050660321
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:hBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsia15gkbQ0e1:/L/g28Ufsxg9GmvPauYLxtX1D/kf
                                                                                                                                                                                                                            MD5:290D936C1E0544B6EC98F031C8C2E9A3
                                                                                                                                                                                                                            SHA1:CAEEA607F2D9352DD605B6A5B13A0C0CB1EA26EC
                                                                                                                                                                                                                            SHA-256:8B00C859E36CBCE3EC19F18FA35E3A29B79DE54DA6030AAAD220AD766EDCDF0A
                                                                                                                                                                                                                            SHA-512:F08B67B633D3A3F57F1183950390A35BF73B384855EAAB3AE895101FBC07BCC4990886F8DE657635AD528D6C861BC2793999857472A5307FFAA963AA6685D7E8
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d....e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):67072
                                                                                                                                                                                                                            Entropy (8bit):6.060461288575063
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:nqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRLpq:nqctkGACFI5t35q2JbgrwwOoqLTM9rMh
                                                                                                                                                                                                                            MD5:5782081B2A6F0A3C6B200869B89C7F7D
                                                                                                                                                                                                                            SHA1:0D4E113FB52FE1923FE05CDF2AB9A4A9ABEFC42E
                                                                                                                                                                                                                            SHA-256:E72E06C721DD617140EDEBADD866A91CF97F7215CBB732ECBEEA42C208931F49
                                                                                                                                                                                                                            SHA-512:F7FD695E093EDE26FCFD0EE45ADB49D841538EB9DAAE5B0812F29F0C942FB13762E352C2255F5DB8911F10FA1B6749755B51AAE1C43D8DF06F1D10DE5E603706
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\PublicKey\_x25519.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                            Entropy (8bit):4.488437566846231
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:tpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADwhDTAbcX6gn/7EC:5VddiT7pgTctdErDwDTicqgn/7
                                                                                                                                                                                                                            MD5:289EBF8B1A4F3A12614CFA1399250D3A
                                                                                                                                                                                                                            SHA1:66C05F77D814424B9509DD828111D93BC9FA9811
                                                                                                                                                                                                                            SHA-256:79AC6F73C71CA8FDA442A42A116A34C62802F0F7E17729182899327971CFEB23
                                                                                                                                                                                                                            SHA-512:4B95A210C9A4539332E2FB894D7DE4E1B34894876CCD06EEC5B0FC6F6E47DE75C0E298CF2F3B5832C9E028861A53B8C8E8A172A3BE3EC29A2C9E346642412138
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d....e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                            Entropy (8bit):4.730605326965181
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
                                                                                                                                                                                                                            MD5:4D9C33AE53B38A9494B6FBFA3491149E
                                                                                                                                                                                                                            SHA1:1A069E277B7E90A3AB0DCDEE1FE244632C9C3BE4
                                                                                                                                                                                                                            SHA-256:0828CAD4D742D97888D3DFCE59E82369317847651BBA0F166023CB8ACA790B2B
                                                                                                                                                                                                                            SHA-512:BDFBF29198A0C7ED69204BF9E9B6174EBB9E3BEE297DD1EB8EB9EA6D7CAF1CC5E076F7B44893E58CCF3D0958F5E3BDEE12BD090714BEB5889836EE6F12F0F49E
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                            Entropy (8bit):4.685843290341897
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
                                                                                                                                                                                                                            MD5:8F4313755F65509357E281744941BD36
                                                                                                                                                                                                                            SHA1:2AAF3F89E56EC6731B2A5FA40A2FE69B751EAFC0
                                                                                                                                                                                                                            SHA-256:70D90DDF87A9608699BE6BBEDF89AD469632FD0ADC20A69DA07618596D443639
                                                                                                                                                                                                                            SHA-512:FED2B1007E31D73F18605FB164FEE5B46034155AB5BB7FE9B255241CFA75FF0E39749200EB47A9AB1380D9F36F51AFBA45490979AB7D112F4D673A0C67899EF4
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_ARC4.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11264
                                                                                                                                                                                                                            Entropy (8bit):4.704418348721006
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:nDzsc9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDj90OcX6gY/7ECFV:Dzs69damqTrpYTst0E5DjPcqgY/79X
                                                                                                                                                                                                                            MD5:85F144F57905F68ECBF14552BAB2F070
                                                                                                                                                                                                                            SHA1:83A20193E6229EA09DCCAE8890A74DBDD0A76373
                                                                                                                                                                                                                            SHA-256:28696C8881D9C9272DE4E54ABE6760CD4C6CB22AD7E3FEABAF6FF313EC9A9EAF
                                                                                                                                                                                                                            SHA-512:533EB4073594BFE97850DFF7353439BACD4E19539E247EE00D599F3468E162D2D88C5CA32322772538A73706DF9A6DD14553B35F47C686D2E20D915FAB766BDA
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...O..e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                            Entropy (8bit):4.968532257508093
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:JF3rugNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDq4wYH/kcX6G:tF/1nb2mhQtkXHTeZ87VDqyMcqgYvEp
                                                                                                                                                                                                                            MD5:14A20ED2868F5B3D7DCFEF9363CB1F32
                                                                                                                                                                                                                            SHA1:C1F2EF94439F42AA39DCDE1075DEFAC8A6029DC6
                                                                                                                                                                                                                            SHA-256:A072631CD1757D5147B5E403D6A96EF94217568D1DC1AE5C67A1892FBF61409E
                                                                                                                                                                                                                            SHA-512:33BE8B3733380C3ADFE5D2844819C754FB11FCBC7AA75DA8FBB4D6CEF938E7D3267FBD215B9666DCFA5795D54484360A61DAF193BC75B57C252D44E5F9F0D855
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...P..e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_chacha20.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                            Entropy (8bit):5.061520684813544
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:cdF/1nb2mhQtkXn0t/WS60YYDEbqvdvGyv9lkVcqgYvEMo:e2f6XSZ6XYD5vdvGyv9MgYvEMo
                                                                                                                                                                                                                            MD5:E2AB7EECFD020CFDEBA6DD3ADD732EB7
                                                                                                                                                                                                                            SHA1:26975087F7AC8001830CAD4151003DBCABF82126
                                                                                                                                                                                                                            SHA-256:85BCF0FD811ADE1396E3A93EEEF6BC6B88D5555498BA09C164FAA3092DACDEFF
                                                                                                                                                                                                                            SHA-512:EB45126A07128E0FA8DC2B687F833BA95BB8703D7BC06E5C34F828EAEF062CFCA56D8A51A73B20DFA771595F6C6D830B659B5C0EB62467C61E95C97C4A73398D
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...P..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                            Entropy (8bit):5.236611028290556
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:osiHXqpoUol3xZhRyQX5lDnRDFFav+tcqgRvE:K6D+XBDfDgRvE
                                                                                                                                                                                                                            MD5:7FA5B1642D52FABFE1D3EBD1080056D4
                                                                                                                                                                                                                            SHA1:56B9E87D613EE9A8B6B71A93ED5FA1603886139A
                                                                                                                                                                                                                            SHA-256:88C7EC96B9E1D168005B3A8727AAA7F76B4B2985083ED7A9FB0A2AB02446E963
                                                                                                                                                                                                                            SHA-512:9E0BF47060A2B7AC8FFD2CB8B845D44013C068BFE74926A67496D79BCB513506625BDA1DDF18ECE7777D1379F036506F19457D0A43FA618A8F75664C47798E64
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K..*...*...*...R...*...U...*..R...*...*...*...U...*...U...*...U...*.....*.....*...}..*.....*..Rich.*..........................PE..d...N..e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):36352
                                                                                                                                                                                                                            Entropy (8bit):6.558039926510444
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:Dz5P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuTLg46:DzdqWB7YJlmLJ3oD/S4j990th9VTsC
                                                                                                                                                                                                                            MD5:E63FC8375E1D8C47FBB84733F38A9552
                                                                                                                                                                                                                            SHA1:995C32515AA183DA58F970CEDC6667FAE166615A
                                                                                                                                                                                                                            SHA-256:F47F9C559A9C642DA443896B5CD24DE74FED713BDF6A9CD0D20F5217E4124540
                                                                                                                                                                                                                            SHA-512:4213189F619E7AA71934033CABA401FE93801B334BA8D8EAFEDA89F19B13224C516E4BB4F4F93F6AE2C21CD8F5586D3FFAC3D16CB1242183B9302A1F408F6F6A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...L..e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15872
                                                                                                                                                                                                                            Entropy (8bit):5.285246086368036
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:jJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4mqccqgwYUMvEW:ZkRwi3wO26Ef+yuIm9PfDewgwYUMvE
                                                                                                                                                                                                                            MD5:A914F3D22DA22F099CB0FBFBBB75DDBF
                                                                                                                                                                                                                            SHA1:2834AEB657CA301D722D6D4D1672239C83BE97E3
                                                                                                                                                                                                                            SHA-256:4B4DBF841EC939EF9CC4B4F1B1BA436941A3F2AF2F4E34F82C568DFC09BA0358
                                                                                                                                                                                                                            SHA-512:15BF5FCE53FB2C524054D02C2E48E3DDC4EAC0C1F73325D58B04DFE17259C208FFAC0A7C634FBC2CF1A08E7F28C1FD456061BA0838F4316EB37514E1E8D4C95F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d...L..e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                                                            Entropy (8bit):5.505232918566824
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:9d9VkyQ5f8vjVaCHpKpTTjaNe7oca2DWZQ2dhmdcqgwNeecBih:rkP5cjIGpKlqD2DakzgwNeE
                                                                                                                                                                                                                            MD5:9F1A2A9D731E7755EE93C82C91FA5FE2
                                                                                                                                                                                                                            SHA1:41085FBE84E1B98A795871033034FA1F186274EF
                                                                                                                                                                                                                            SHA-256:17F3EAF463868B015583BD611BE5251E36AAB616522FF4072011B3D72F6F552F
                                                                                                                                                                                                                            SHA-512:7E29D4729837D87AEF34CFA7B1F86DFBB81907CD11FC575C4ED1B8A956409492315BFA76ADE4D7C51E51E37E5D098A7F4FEE4C58D86D0E6245A4AA0D392D488A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...L..e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):20992
                                                                                                                                                                                                                            Entropy (8bit):6.061115794354147
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:pUv5cJMOZA0nmwBD+XpJgLa0Mp8QHg4P2llyM:GK1XBD+DgLa1gTi
                                                                                                                                                                                                                            MD5:883DE82B3B17F95735F579E78A19D509
                                                                                                                                                                                                                            SHA1:3EC7259ACA3730B2A6F4E1CA5121DB4AB41C619E
                                                                                                                                                                                                                            SHA-256:67FF6C8BBDC9E33B027D53A26DF39BA2A2AD630ACCE1BAC0B0583CA31ADF914F
                                                                                                                                                                                                                            SHA-512:602915EAA0933F5D1A26ECC1C32A8367D329B12794CBF2E435B1704E548858E64710AB52BC6FC14FC98DF0B8EEBDE2B32A35BCF935079CC8E2412C07DF5303FD
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...L..e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):25088
                                                                                                                                                                                                                            Entropy (8bit):6.475398255636883
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:Zc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy7IYgLWi:q6H1TZXX5XmrXA+NNxWi0dLWi
                                                                                                                                                                                                                            MD5:0AC22DA9F0B2F84DE9D2B50D457020C1
                                                                                                                                                                                                                            SHA1:682E316AE958121D0E704CAB0F78CCAD42C77573
                                                                                                                                                                                                                            SHA-256:480C79C713AD15328E9EB9F064B90BCDCB5AAD149236679F97B61218F6D2D200
                                                                                                                                                                                                                            SHA-512:11C04D55C5E73583D658E0918BD5A37C7585837A6E0F3C78AEF10A5D7A5C848B0620028177A9D9B0AD5DB882B2A26624F92BEFC9BC8F8A23C002723E50DD80A5
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...M..e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                            Entropy (8bit):4.839420412830416
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:CF/1nb2mhQtkr+juOxKbDbRHcqgYvEkrK:42f6iuOsbDXgYvEmK
                                                                                                                                                                                                                            MD5:6840F030DF557B08363C3E96F5DF3387
                                                                                                                                                                                                                            SHA1:793A8BA0A7BDB5B7E510FC9A9DDE62B795F369AE
                                                                                                                                                                                                                            SHA-256:B7160ED222D56925E5B2E247F0070D5D997701E8E239EC7F80BCE21D14FA5816
                                                                                                                                                                                                                            SHA-512:EDF5A4D5A3BFB82CC140CE6CE6E9DF3C8ED495603DCF9C0D754F92F265F2DCE6A83F244E0087309B42930D040BF55E66F34504DC1C482A274AD8262AA37D1467
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...N..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                            Entropy (8bit):4.905258571193623
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:fRgPX8lvI+KnwSDTPUDEnKWPXcqgzQkvEd:4og9rUD/mpgzQkvE
                                                                                                                                                                                                                            MD5:7256877DD2B76D8C6D6910808222ACD8
                                                                                                                                                                                                                            SHA1:C6468DB06C4243CE398BEB83422858B3FED76E99
                                                                                                                                                                                                                            SHA-256:DBF703293CFF0446DFD15BBAEDA52FB044F56A353DDA3BECA9AADD8A959C5798
                                                                                                                                                                                                                            SHA-512:A14D460D96845984F052A8509E8FC44439B616EEAE46486DF20F21CCAA8CFB1E55F1E4FA2F11A7B6AB0A481DE62636CEF19EB5BEF2591FE83D415D67EB605B8E
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d...N..e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                            Entropy (8bit):5.300728193650235
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:jGYJ1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDr6krRcqgUF6+6vEX:jR01si8XSi3SACqe7tDlDgUUjvE
                                                                                                                                                                                                                            MD5:B063D73E5AA501060C303CAFBC72DAD3
                                                                                                                                                                                                                            SHA1:8C1CA04A8ED34252EB233C993DDBA17803E0B81E
                                                                                                                                                                                                                            SHA-256:98BACA99834DE65FC29EFA930CD9DBA8DA233B4CFDFC4AB792E1871649B2FE5C
                                                                                                                                                                                                                            SHA-512:8C9AD249F624BDF52A3C789C32532A51D3CC355646BD725553A738C4491EA483857032FB20C71FD3698D7F68294E3C35816421DFF263D284019A9A4774C3AF05
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..*B..*B..*B..R...*B..UC..*B.RC..*B..*C..*B..UG..*B..UF..*B..UA..*B..J..*B..B..*B....*B..@..*B.Rich.*B.........................PE..d...O..e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_des.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):57856
                                                                                                                                                                                                                            Entropy (8bit):4.260136375669177
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:9RUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZvZY0JAIg+v:9rHGHfJidIK
                                                                                                                                                                                                                            MD5:3AEA5302F7F03EDEFF49D1C119C61693
                                                                                                                                                                                                                            SHA1:DBDDE1C10B253744153FC1F47C078AAACCF3F3A6
                                                                                                                                                                                                                            SHA-256:E5DDA67D4DF47B7F00FF17BE6541CA80BDB4B60E1F6FD1A7D7F115DDF7683EE5
                                                                                                                                                                                                                            SHA-512:DD42C24EDAF7E1B25A51BC8C96447496B3289C612C395CA7BD8BF60A162229C2E0CA0432CDDF1CB2D65D80189DB02BEE42FFD0E7DD9E5FC19278CA3FD593AB2C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d...M..e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):58368
                                                                                                                                                                                                                            Entropy (8bit):4.276947153784193
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:98Uqho9weF5/eHkRnYcZiGKdZHDL7idErZ8ZYXGg:9gCneH//idv2
                                                                                                                                                                                                                            MD5:BA5BA714AEBFD8130EB6E0983FBAE20B
                                                                                                                                                                                                                            SHA1:3309C26A9083EC3AD982DD3D6630FCC16465F251
                                                                                                                                                                                                                            SHA-256:861167DFEB390261E538D635EAD213E81C1166D8D85A496774FBF2EBFF5A4332
                                                                                                                                                                                                                            SHA-512:309CC3FD8DB62517AE70B404C5ACD01052F10582A17123135CD1A28D3A74AB28F90A8E7ED7D2061A4B6C082F85E98DA822D43986FC99367B288A72BA9F8B5569
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d...N..e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                            Entropy (8bit):4.579354442149926
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:j0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwoYPj15XkcX6gbW6z:pVddiT7pgTctEEI4qXDe11kcqgbW6
                                                                                                                                                                                                                            MD5:1C74E15EC55BD8767968024D76705EFC
                                                                                                                                                                                                                            SHA1:C590D1384D2207B3AF01A46A5B4F7A2AE6BCAD93
                                                                                                                                                                                                                            SHA-256:0E3EC56A1F3C86BE1CAA503E5B89567AA91FD3D6DA5AD4E4DE4098F21270D86B
                                                                                                                                                                                                                            SHA-512:E96CA56490FCE7E169CC0AB803975BAA8B5ACB8BBAB5047755AE2EEAE177CD4B852C0620CD77BCFBC81AD18BB749DEC65D243D1925288B628F155E8FACDC3540
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...N..e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):22016
                                                                                                                                                                                                                            Entropy (8bit):6.143744403797058
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:7Uv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Qy0gYP2lXCM:UKR8I+K0lDFQgLa1WzU
                                                                                                                                                                                                                            MD5:E7826C066423284539BD1F1E99BA0CC6
                                                                                                                                                                                                                            SHA1:DA7372EEB180C2E9A6662514A8FA6261E04AC6DC
                                                                                                                                                                                                                            SHA-256:0E18B7C2686BB954A8EE310DD5FDB76D00AC078A12D883028BFFC336E8606DA2
                                                                                                                                                                                                                            SHA-512:55F8B00B54F3C3E80803D5A3611D5301E29A2C6AF6E2CAA36249AEBA1D4FCC5A068875B34D65106C137F0455F11B20226B48EEF687F5EA73DFEA3C852BF07050
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...M..e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):17920
                                                                                                                                                                                                                            Entropy (8bit):5.353670931504009
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:tPHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8Ng6Vf4A:DPcnB8KSsB34cb+bcOYpMCBDB
                                                                                                                                                                                                                            MD5:D5DB7192A65D096433F5F3608E5AD922
                                                                                                                                                                                                                            SHA1:22AD6B635226C8F6B94F85E4FBFB6F8C18B613C8
                                                                                                                                                                                                                            SHA-256:FAB286E26160820167D427A4AAB14BE4C23883C543E2B0C353F931C89CEA3638
                                                                                                                                                                                                                            SHA-512:5503E83D68D144A6D182DCC5E8401DD81C1C98B04B5ED24223C77D94B0D4F2DD1DD05AED94B9D619D30D2FE73DFFA6E710664FFC71B8FA53E735F968B718B1D9
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...O..e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                            Entropy (8bit):4.741875402338703
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:sCF/1nb2mhQtkgU7L9D0E7tfcqgYvEJPb:N2f6L9D5JxgYvEJj
                                                                                                                                                                                                                            MD5:134F891DE4188C2428A2081E10E675F0
                                                                                                                                                                                                                            SHA1:22CB9B0FA0D1028851B8D28DAFD988D25E94D2FD
                                                                                                                                                                                                                            SHA-256:F326AA2A582B773F4DF796035EC9BF69EC1AD11897C7D0ECFAB970D33310D6BA
                                                                                                                                                                                                                            SHA-512:43CE8AF33630FD907018C62F100BE502565BAD712AD452A327AE166BD305735799877E14BE7A46D243D834F3F884ABF6286088E30533050ED9CD05D23AACAEAB
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...O..e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                            Entropy (8bit):5.213290591994899
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:oF/1nb2mhQtkRySMfJ2ycxFzShJD9dAal2QDeJKcqgQx2QY:C2fKRQB2j8JD4fJagQx2QY
                                                                                                                                                                                                                            MD5:7D6979D69CD34652D5A3A197300AB65C
                                                                                                                                                                                                                            SHA1:E9C7EF62B7042B3BAC75B002851C41EFEEE343CE
                                                                                                                                                                                                                            SHA-256:2365B7C2AF8BBAC3844B7BEF47D5C49C234A159234A153515EB0634EEC0557CC
                                                                                                                                                                                                                            SHA-512:CBDBE0DF4F6CB6796D54969B0EEF06C0CDA86FF34A2B127BF0272C819FB224D6E5393D5C9B31E53A24EAC9A3A1AEA6E0854A8D7911CF7C4C99292C931B8B05DF
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...J..e.........." ...%..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                                            Entropy (8bit):5.181893965844124
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:cF/1nb2mhQt7fSOp/CJPvADQoKtxSOvbcqgEvcM+:22fNKOZWPIDMxVlgEvL
                                                                                                                                                                                                                            MD5:C3BA97B2D8FFFDB05F514807C48CABB2
                                                                                                                                                                                                                            SHA1:7BC7FBDE6A372E5813491BBD538FD49C0A1B7C26
                                                                                                                                                                                                                            SHA-256:4F78E61B376151CA2D0856D2E59976670F5145FBABAB1EEC9B2A3B5BEBB4EEF6
                                                                                                                                                                                                                            SHA-512:57C1A62D956D8C6834B7BA81C2D125A40BF466E833922AE3759CF2C1017F8CAF29F4502A5A0BCBC95D74639D86BAF20F0335A45F961CFCAC39B4ED81E318F4EB
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...K..e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD2.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14336
                                                                                                                                                                                                                            Entropy (8bit):5.1399121410532445
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:HsiHXqpo0cUp8XnUp8XjEQnlDtTI6rcqgcx2:J6DcUp8XUp8AclDy69gcx2
                                                                                                                                                                                                                            MD5:BB4CF5E97D4031B47CC7B7DAEDA005DD
                                                                                                                                                                                                                            SHA1:4F596DCE9A8546AE22BA8851B22FCE62C2C69973
                                                                                                                                                                                                                            SHA-256:325512FF7E0261AF1DA4760C5A8BB8BA7BA8C532F0068D770621CD2CC89E04C6
                                                                                                                                                                                                                            SHA-512:93088745BA922918A8EBC20C7043DA4C3C639245547BE665D15625B7F808EC0BF120841ACEEFCE71134921EF8379821769DE35D32CCCC55E6B391C57C7F4D971
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...A..e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD4.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13824
                                                                                                                                                                                                                            Entropy (8bit):5.204576067987685
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:JsiHXqpwUiv6wPf+4WVrd1DFrXqwWwcqgfvE:36biio2Pd1DFrlgfvE
                                                                                                                                                                                                                            MD5:D2131380B7760D5BC3C2E1772C747830
                                                                                                                                                                                                                            SHA1:DA5838E1C6DF5EC45AC0963E98761E9188A064D0
                                                                                                                                                                                                                            SHA-256:6DB786B30F6682CD699E22D0B06B873071DCC569557B6EB6EC1416689C0890FE
                                                                                                                                                                                                                            SHA-512:594939FB1D9154E15106D4B4AA9EF51A6AE5062D471ED7C0779A8E3D84D8F4B1481529015E0926A3489119DA37BE6CFE70C70ED695A6E84F6AF8F65402F6AAB5
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_MD5.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                            Entropy (8bit):5.4787123381499825
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:3Z9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZuRsP0rcqgjPrvE:SQ0gH7zSccA5J6ECTGmDMa89gjPrvE
                                                                                                                                                                                                                            MD5:CAF687A7786892939FFF5D5B6730E069
                                                                                                                                                                                                                            SHA1:96C2567A770E12C15903767A85ABF8AF57FE6D6A
                                                                                                                                                                                                                            SHA-256:9001E0C50D77823D64C1891F12E02E77866B9EDE783CEF52ED4D01A32204781B
                                                                                                                                                                                                                            SHA-512:0B3C9E5C1F7EF52E615D9E1E6F7D91324BAB7C97FFAFB6DBAEB229CF1B86420A3534493C34DD9FAEB4BBC3612F245248ABA34393311C31500D827538DFE24BC5
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):18432
                                                                                                                                                                                                                            Entropy (8bit):5.69653684522693
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:pkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+D0ngkov:2nx7RI26LuuHKz8+D5N
                                                                                                                                                                                                                            MD5:9762DBF0527A46F21852CA5303E245C3
                                                                                                                                                                                                                            SHA1:33333912F16BB755B0631D8308D94DA2D7589127
                                                                                                                                                                                                                            SHA-256:0DF91D69B8D585D2660168125E407E3CB3D87F338B3628E5E0C2BF49C9D20DB8
                                                                                                                                                                                                                            SHA-512:52687C38939710C90A8C97F2C465AF8CF0309E3939255427B88BC461E27FADA79B0CB31F8BD215F72B610CAC093934C066141B9298353F04CC067C4E68B31DF0
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...J..e.........." ...%.*... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA1.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):19456
                                                                                                                                                                                                                            Entropy (8bit):5.798411671336839
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:cPHNP3MjevhSY/8EBbVxcJ0ihTLdFDUPHgj+kf4D:mPcKvr/jUJ0sbDoAj+t
                                                                                                                                                                                                                            MD5:74DAAAB71F93BCE184D507A45A88985C
                                                                                                                                                                                                                            SHA1:3D09D69E94548EC6975177B482B68F86EDA32BB8
                                                                                                                                                                                                                            SHA-256:E781D6DAF2BAAA2C1A45BD1CDDB21BA491442D49A03255C1E367F246F17E13BF
                                                                                                                                                                                                                            SHA-512:870EC2752304F12F2F91BE688A34812AC1C75D444A0107284E3C45987639D8D07116EB98DB76931F9C8487666E1B2C163FC5743BBFC5A72F20F040670CDEB509
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...B..e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA224.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):22016
                                                                                                                                                                                                                            Entropy (8bit):5.86552932624144
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:V1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOhwgjxo:XjwyJUYToZwOLuzDNU1j
                                                                                                                                                                                                                            MD5:92587A131875FF7DC137AA6195B8BD81
                                                                                                                                                                                                                            SHA1:2BA642DDC869AB329893795704BFE3F23C7B6ECB
                                                                                                                                                                                                                            SHA-256:D2A9484134A65EFF74F0BDA9BB94E19C4964B6C323667D68B4F45BB8A7D499FC
                                                                                                                                                                                                                            SHA-512:62823A0168B415045A093ACC67E98B5E33908380860B04AA0568B04F39DE957DA30F929459C766DC9782EFC3143DCD2F4950E3876669E680B6910C213300B565
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...F..e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA256.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):22016
                                                                                                                                                                                                                            Entropy (8bit):5.867427817795374
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:b1jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNWegjxo:ZjwyJOYToZwOLuzDNW7j
                                                                                                                                                                                                                            MD5:B4E18C9A88A241FD5136FAF33FB9C96A
                                                                                                                                                                                                                            SHA1:077AF274AA0336880391E2F38C873A72BFC1DE3B
                                                                                                                                                                                                                            SHA-256:E50DB07E18CB84827B0D55C7183CF580FB809673BCAFBCEF60E83B4899F3AA74
                                                                                                                                                                                                                            SHA-512:81A059115627025A7BBF8743B48031619C13A513446B0D035AA25037E03B6A544E013CAAEB139B1BE9BA7D0D8CF28A5E7D4CD1B8E17948830E75BDFBD6AF1653
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...D..e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA384.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27136
                                                                                                                                                                                                                            Entropy (8bit):5.860145427724178
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:TFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDFfgjVx2:xDLh98jjRe+1WT1aAeIfMzxH2mDDqj
                                                                                                                                                                                                                            MD5:34A0AD8A0EB6AC1E86DC8629944448ED
                                                                                                                                                                                                                            SHA1:EF54E4C92C123BE341567A0ACC17E4CEE7B9F7A8
                                                                                                                                                                                                                            SHA-256:03E93C2DCC19C3A0CDD4E8EFCDE90C97F6A819DFECF1C96495FDC7A0735FAA97
                                                                                                                                                                                                                            SHA-512:A38EDE4B46DC9EFA80DFB6E019379809DF78A671F782660CD778427482B0F5987FA80A42C26FB367604BAFCD4FD21ABD1C833DAF2D4AEA3A43877F54D6906E21
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...G..e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_SHA512.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27136
                                                                                                                                                                                                                            Entropy (8bit):5.916758045478156
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:LFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXCElrgjhig:5YLB9Mgj0e+1WT1aAeIfMzx320DXR+j
                                                                                                                                                                                                                            MD5:F028511CD5F2F925FD5A979152466CB4
                                                                                                                                                                                                                            SHA1:38B8B44089B390E1F3AA952C950BDBE2CB69FBA5
                                                                                                                                                                                                                            SHA-256:0FB591416CC9520C6D9C398E1EDF4B7DA412F80114F80628F84E9D4D37A64F69
                                                                                                                                                                                                                            SHA-512:97C06A4DCEE7F05268D0A47F88424E28B063807FFBD94DABDCC3BF773AD933A549934916EB7339506624E97829AA5DC13321ADE31D528E8424FFDCF8C8407D4F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...I..e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12800
                                                                                                                                                                                                                            Entropy (8bit):5.0002940201841
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:Dz/RF/1nb2mhQtk4axusjfkgZhoYDQmRjcqgQvEty:Dz/d2f64axnTTz5DTgQvEty
                                                                                                                                                                                                                            MD5:87C1C89CEB6DF9F62A8F384474D27A4A
                                                                                                                                                                                                                            SHA1:B0FC912A8DE5D9C18F603CD25AE3642185FFFBDD
                                                                                                                                                                                                                            SHA-256:D2256A5F1D3DC6AE38B73EA2DB87735724D29CB400D00D74CF8D012E30903151
                                                                                                                                                                                                                            SHA-512:C7DFB9C8E4F4AA984416BC84E829F0BB6CD87829C86BA259EE2A9BAB7C16B15362DB9EC87BF2ACED44A6BED7B1DE03DC9450665D083205B4CD4780DCF480DA01
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*b..*b..*b..R...*b..Uc..*b.Rc..*b..*c..*b..Ug..*b..Uf..*b..Ua..*b..j..*b..b..*b....*b..`..*b.Rich.*b.................PE..d...K..e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13312
                                                                                                                                                                                                                            Entropy (8bit):5.025717576776578
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:FF/1nb2mhQtks0iiNqdF4mtPjD0HA5APYcqgYvEL2x:R2f6fFA/4GjDucgYvEL2x
                                                                                                                                                                                                                            MD5:20702216CDA3F967DF5C71FCE8B9B36F
                                                                                                                                                                                                                            SHA1:4D9A814EE2941A175BC41F21283899D05831B488
                                                                                                                                                                                                                            SHA-256:3F73F9D59EB028B7F17815A088CEB59A66D6784FEEF42F2DA08DD07DF917DD86
                                                                                                                                                                                                                            SHA-512:0802CF05DAD26E6C5575BBECB419AF6C66E48ED878F4E18E9CEC4F78D6358D751D41D1F0CCB86770A46510B993B70D2B320675422A6620CE9843E2E42193DCD8
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d...K..e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_keccak.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):16384
                                                                                                                                                                                                                            Entropy (8bit):5.235441330454107
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:VTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gD/gvrjcqgCieT3WQ:VafgNpj9cHW3jqXeBRamD4ZgCieT
                                                                                                                                                                                                                            MD5:F065FFB04F6CB9CDB149F3C66BC00216
                                                                                                                                                                                                                            SHA1:B2BC4AF8A3E06255BAB15D1A8CF4A577523B03B6
                                                                                                                                                                                                                            SHA-256:E263D7E722EC5200E219D6C7D8B7C1B18F923E103C44A0B5485436F7B778B7BD
                                                                                                                                                                                                                            SHA-512:93E583B10D0F2BBB1D5539FF4E943A65BC67F6DFC51E5F991481574F58757F4D49A87022E551069F6FC55D690F7B1412CF5DE7DD9BEE27FB826853CE9ACC2B40
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...J..e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Hash\_poly1305.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15360
                                                                                                                                                                                                                            Entropy (8bit):5.133851517560629
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:zZNGXEgvUh43G6coX2SSwmPL4V7wTdDlDaY2cqgWjvE:mVMhuGGF2L4STdDEYWgWjvE
                                                                                                                                                                                                                            MD5:213AAEC146F365D950014D7FFF381B06
                                                                                                                                                                                                                            SHA1:66FCD49E5B2278CD670367A4AC6704A59AE82B50
                                                                                                                                                                                                                            SHA-256:CAF315A9353B2306880A58ECC5A1710BFE3AA35CFEAD7CF0528CAEE4A0629EAD
                                                                                                                                                                                                                            SHA-512:0880D7D2B2C936A4B85E6C2A127B3509B76DB4751A3D8A7BB903229CABC8DE7A7F52888D67C886F606E21400DFC51C215D1CF9C976EB558EA70975412840883A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d...K..e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Math\_modexp.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):35840
                                                                                                                                                                                                                            Entropy (8bit):5.927928056434685
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:KbEkzS7+k9rMUb8cOe9rs9ja+V/Mhxh56GS:KbEP779rMtcOCs0I/Mjf
                                                                                                                                                                                                                            MD5:732938D696EB507AF4C37795A4F9FCEA
                                                                                                                                                                                                                            SHA1:FD585EA8779C305ADBE3574BE95CFD06C9BBD01C
                                                                                                                                                                                                                            SHA-256:1383269169AB4D2312C52BF944BD5BB80A36D378FD634D7C1B8C3E1FFC0F0A8C
                                                                                                                                                                                                                            SHA-512:E4EBC5470F3D05D79B65BC2752A7FF40F5525CD0813BDDECCB1042EE2286B733EE172383186E89361A49CBE0B4B14F8B2CBC0F32E475101385C634120BB36676
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d...S..e.........." ...%.^...0......`.....................................................`..........................................~..|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Protocol\_scrypt.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12288
                                                                                                                                                                                                                            Entropy (8bit):4.799297116284292
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:UkCfXASTMeAk4OepIXcADpOX6RcqgO5vE:+JMcPepIXcADq63gO5vE
                                                                                                                                                                                                                            MD5:9E7B28D6AB7280BBB386C93EF490A7C1
                                                                                                                                                                                                                            SHA1:B088F65F3F6E2B7D07DDBE86C991CCD33535EF09
                                                                                                                                                                                                                            SHA-256:F84667B64D9BE1BCC6A91650ABCEE53ADF1634C02A8A4A8A72D8A772432C31E4
                                                                                                                                                                                                                            SHA-512:16A6510B403BF7D9ED76A654D8C7E6A0C489B5D856C231D12296C9746AC51CD372CC60CA2B710606613F7BC056A588C54EA24F9C0DA3020BBEA43E43CEEB9CA4
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...*...*...*...RQ..*...U...*..R...*...*...*...U...*...U...*...U...*......*......*...=..*......*..Rich.*..................PE..d...P..e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):754688
                                                                                                                                                                                                                            Entropy (8bit):7.6249603206444005
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:l1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6hM:XYmzHoxJFf1p34hcrn5Go9yQO6q
                                                                                                                                                                                                                            MD5:102898D47B45548E7F7E5ECC1D2D1FAA
                                                                                                                                                                                                                            SHA1:DDAE3A3BDD8B83AF42126245F6CB24DC2202BC04
                                                                                                                                                                                                                            SHA-256:C9BF3CF5707793C6026BFF68F2681FAAD29E953ED891156163CD0B44A3628A92
                                                                                                                                                                                                                            SHA-512:85A42FC08C91AFF50A9FF196D6FE8ABD99124557341B9809B62A639957B166C2A7EFEA0A042BE2D753464DF5908DF4F5FE01A91C239B744CD44A70B79EF81048
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d...R..e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):27648
                                                                                                                                                                                                                            Entropy (8bit):5.792776923715812
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:mBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsla15gkbQ0e1:cL/g28Ufsxg9GmvPauYLxtX1D8kf
                                                                                                                                                                                                                            MD5:717DA232A3A9F0B94AF936B30B59D739
                                                                                                                                                                                                                            SHA1:F1B3676E708696585FBCB742B863C5BB913D923F
                                                                                                                                                                                                                            SHA-256:B3FD73D54079903C0BE39BA605ED9BB58ECD1D683CCB8821D0C0CC795165B0C6
                                                                                                                                                                                                                            SHA-512:7AF46035F9D4A5786ED3CE9F97AC33637C3428EF7183DED2AFD380265FAE6969BB057E3B5D57C990DD083A9DB2A67BEA668D4215E78244D83D7EE7E0A7B40143
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d...R..e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_ed448.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):67072
                                                                                                                                                                                                                            Entropy (8bit):6.060435635420756
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:YqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxROpq:YqctkGACFI5t35q2JbgrwwOoqLTM9rMq
                                                                                                                                                                                                                            MD5:ADF96805C070920EA90D9AB4D1E35807
                                                                                                                                                                                                                            SHA1:D8FA8E29D9CDCD678DC03DA527EAF2F0C3BEF21A
                                                                                                                                                                                                                            SHA-256:A36B1EDC104136E12EB6F28BD9366D30FFCEC0434684DC139314723E9C549FB7
                                                                                                                                                                                                                            SHA-512:FB67C1F86CF46A63DF210061D16418589CD0341A6AA75AB49F24F99AD3CFF874BB02664706B9E2C81B7EF7300AF5BB806C412B4F069D22B72F7D9EBFFF66FE61
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.|.U./.U./.U./.-a/.U./.*...U./A-...U./.U./!U./.*...U./.*...U./.*...U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d...S..e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\PublicKey\_x25519.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                            Entropy (8bit):4.488514144301916
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:IpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADBhDTAbcX6gn/7EC:uVddiT7pgTctdErDDDTicqgn/7
                                                                                                                                                                                                                            MD5:148E1600E9CBAF6702D62D023CAC60BC
                                                                                                                                                                                                                            SHA1:4CDD8445408C4165B6E029B9966C71BC45E634A2
                                                                                                                                                                                                                            SHA-256:1461AAFD4B9DC270128C89C3EB5358794C77693BB943DC7FC42AA3BB0FC52B16
                                                                                                                                                                                                                            SHA-512:53155DA3FD754AF0BC30E2A51F0B579B8A83A772025CE0B4AFD01A31B8A40F46533FDA9CC3D0D32E9480DBBD7DD4A28F9DAAC11A370B0435E5E74666ACF9181C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d...R..e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Util\_cpuid_c.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                            Entropy (8bit):4.731194408014124
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:lJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGybMZYJWJcX6gbW6s:JVddiT7pgTctEEaEDKDuMCWJcqgbW6
                                                                                                                                                                                                                            MD5:1547F8CB860AB6EA92B85D4C1B0209A1
                                                                                                                                                                                                                            SHA1:C5AE217DEE073AC3D23C3BF72EE26D4C7515BD88
                                                                                                                                                                                                                            SHA-256:1D2F3E627551753E58ED9A85F8D23716F03B51D8FB5394C4108EB1DC90DC9185
                                                                                                                                                                                                                            SHA-512:40F0B46EE837E4568089D37709EF543A987411A17BDBAE93D8BA9F87804FB34DCA459A797629F34A5B3789B4D89BD46371AC4F00DDFE5D6B521DEA8DC2375115
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...N..e.........." ...%............P........................................p............`..........................................'..|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Cryptodome\Util\_strxor.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10240
                                                                                                                                                                                                                            Entropy (8bit):4.686131723746002
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:EiZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DmWMoG4BcX6gbW6O:HVddiT7pgTctEEO3DcoHcqgbW6
                                                                                                                                                                                                                            MD5:16F42DE194AAEFB2E3CDEE7FA63D2401
                                                                                                                                                                                                                            SHA1:BE2AB72A90E0342457A9D13BE5B6B1984875EDEA
                                                                                                                                                                                                                            SHA-256:61E23970B6CED494E11DC9DE9CB889C70B7FF7A5AFE5242BA8B29AA3DA7BC60E
                                                                                                                                                                                                                            SHA-512:A671EA77BC8CA75AEDB26B73293B51B780E26D6B8046FE1B85AE12BC9CC8F1D2062F74DE79040AD44D259172F99781C7E774FE40768DC0A328BD82A48BF81489
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d...P..e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imaging.cp311-win_amd64.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):2341888
                                                                                                                                                                                                                            Entropy (8bit):6.5065928437689475
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:49152:29Q79HlVQQ/ptaWa1f6yWKEPsoU0lP0h:3HI7fbEPsoU0y
                                                                                                                                                                                                                            MD5:B726A47FEDC2F10FC6AD3C040A9B1188
                                                                                                                                                                                                                            SHA1:ACF2D39739CDA8EF314E0889924A39CA0CDF5CCE
                                                                                                                                                                                                                            SHA-256:EAAD1713DBCAE6191B925A12CE4065DE247ABBC06B8B1E6B36093B38D8703B29
                                                                                                                                                                                                                            SHA-512:3E1FFE28AA95556E14C60FF517BBE44C164CA030A836D39446E61BDDCD2D8F39231B551A5E6D800289D28A259767694594484887026F2803408F12D1EA363FDE
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......................o.....W[......W[......W[......W[......W[.......Y..............................\.......\.......\.......\.......\......Rich............................PE..d....I.f.........." ...(.............{.......................................0$...........`.........................................05".`....5".......$.......#...............$.....0. ....................... .(..... .@............@..(............................text....,.......................... ..`.rdata..$....@.......2..............@..@.data........`"..b...D".............@....pdata........#.......".............@..@.rsrc.........$.......#.............@..@.reloc........$.......#.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imagingcms.cp311-win_amd64.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):263168
                                                                                                                                                                                                                            Entropy (8bit):6.278905574145053
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:KdcKQcsu5mV6SGRI7O9hHTnLg9uP1+74/LgHmPr9qvZqhLaHLTLrLfqeqwLfp694:KdOcvm8hHTnLg9uP1+74/LgHmPr9qvZx
                                                                                                                                                                                                                            MD5:F5F4E931731BEA017E78CDCA6E038C7F
                                                                                                                                                                                                                            SHA1:92BECFCFB2D37B98BEC87ABFACC70A9769BA7F70
                                                                                                                                                                                                                            SHA-256:08F2DCCC7FDC49B641FD234BD13C6F5237D236AB7A3B3CA26B30CD5012154AB7
                                                                                                                                                                                                                            SHA-512:82F427B95227ADEF6CD2BD8533E01CA4AB2761F914150E30DE5E2BDBCB33BD6D543A4F965918E331C4767C9E7747C29930F1E013EE45574C012016A8D41C448D
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.}.qh..qh..qh..x....h.....sh.....uh.....yh.....|h......sh..:...vh..qh...h..b...gh..b...ph..b...ph..b...ph..Richqh..........PE..d....I.f.........." ...(....."...............................................@............`......................................... ...h............ .........../...........0.......`..............................._..@...............`............................text...X........................... ..`.rdata.............................@..@.data....>.......:..................@....pdata.../.......0..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imagingmath.cp311-win_amd64.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):24064
                                                                                                                                                                                                                            Entropy (8bit):5.630145214999331
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:JYwU58xEr4Pp/zosXo1USBOaD5p7l1rFXckOgaUJI:JYp8mrszoT1USsq1rNc+aT
                                                                                                                                                                                                                            MD5:04FA6E0FB34ED332583F5D9E049B04A2
                                                                                                                                                                                                                            SHA1:81147863EBB39350FACED61729C9BFCBA9A78EC9
                                                                                                                                                                                                                            SHA-256:E3F179BB353106B74FD3259595F2D2D3BB1207E4931DA594ED4DF72D4AC98196
                                                                                                                                                                                                                            SHA-512:9F191E6410DBCAF8D325878DD9319464C68AC476620E34CD02B957556BE7670407729CD6843574EB9F37E6B287C4F3AAEC62BF9A9C20E5F3FCAF119EB132F9CB
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f...".".".+...&..a.. .i... ..a..!..a..*..a....Mc..!."...1f..#.1f..#.1fo.#.1f..#.Rich".........................PE..d....I.f.........." ...(.6...*......p8....................................................`.........................................@`..h....`..x...............8...............@....U...............................S..@............P..`............................text...X4.......6.................. ..`.rdata.......P.......:..............@..@.data...P....p.......P..............@....pdata..8............R..............@..@.rsrc................Z..............@..@.reloc..@............\..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_imagingtk.cp311-win_amd64.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                            Entropy (8bit):5.058731186917024
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:OGrzuZtIEeElbMdd0Fyd3KE+2iV3Ww2AXs9CoLckgTN2T:HuZgEagyPVS2AXXo7gTN2
                                                                                                                                                                                                                            MD5:DDC5D5270757717F698FC06DCB76032B
                                                                                                                                                                                                                            SHA1:C35D0212284DA2E0ABFEF99C63C116010945D11A
                                                                                                                                                                                                                            SHA-256:8CC471F2F167E5EDA1398373EEB7C6689420DA308D50771745ABDED73EEE7EEF
                                                                                                                                                                                                                            SHA-512:81A74A48958C921ABB648BBA700042CBAC5669DF4F9118F1102A020DC9B101DE7E2C1E1022BA526B0D830BFA8AC30EC037F449784E24F90CACE2CC7B86ED7A30
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>B.mmB.mmB.mmK..mH.mm.3ll@.mm.3nlA.mm.3ilJ.mm.3hlN.mm-1ll@.mm..llG.mmB.lmv.mmQ4el@.mmQ4mlC.mmQ4.mC.mmQ4olC.mmRichB.mm................PE..d....I.f.........." ...(.....$......0.....................................................`..........................................;..d....<.......p.......`..................<...`5.............................. 4..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data...X....P.......0..............@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc..<............8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\PIL\_webp.cp311-win_amd64.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):412672
                                                                                                                                                                                                                            Entropy (8bit):6.529285441982242
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:62/DU54t1cEXIIuG9Bq9lCsJBbYQBPexnCODrp7H2QcGz8uijr:62Qut17XtuG69bY65OQQcFumr
                                                                                                                                                                                                                            MD5:CDA7EED01BEFD363C17F042727B6184A
                                                                                                                                                                                                                            SHA1:5FD1FCCE15B2277B6B02985E54724DAF04467B18
                                                                                                                                                                                                                            SHA-256:5AAD99A74F8C37855C98948E2F5495A07750891CB907267FB34620373E2655C4
                                                                                                                                                                                                                            SHA-512:9FB70085DA3074A8C9DA0C454E721B0C6D94B4395F011CB342D698B3DD74EBC2F960B2BFA85B84B0E912B3A51F226DA2B4C362D9A7DCAAC56951126D4D61535E
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:7|.~V..~V..~V..w...tV......|V..5...|V......zV......vV......sV......}V..~V..)V..m...)V..m....V..m....V..m...V..m....V..Rich~V..................PE..d....I.f.........." ...(.....^............................................................`.............................................\....................`...<..................p...............................0...@............0...............................text............................... ..`.rdata.......0......................@..@.data....2... ......................@....pdata...<...`...>..................@..@.rsrc................H..............@..@.reloc...............J..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin\mfc140u.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):5653424
                                                                                                                                                                                                                            Entropy (8bit):6.729277267882055
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                                                                                                                                                                                                                            MD5:03A161718F1D5E41897236D48C91AE3C
                                                                                                                                                                                                                            SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                                                                                                                                                                                                                            SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                                                                                                                                                                                                                            SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\Pythonwin\win32ui.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1143296
                                                                                                                                                                                                                            Entropy (8bit):6.042100978272984
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:+jUcbgAIjeB47XV6LMDANfo4KR0fpCTuWpG0LwP8Ehzf3N:+DbOG47X3ANfoNnTt40TEhL3
                                                                                                                                                                                                                            MD5:0E96B5724C2213300864CEB36363097A
                                                                                                                                                                                                                            SHA1:151931D9162F9E63E8951FC44A9B6D89AF7AF446
                                                                                                                                                                                                                            SHA-256:85CF3081B0F1ADAFDBDCF164D7788A7F00E52BACDF02D1505812DE4FACFC962F
                                                                                                                                                                                                                            SHA-512:46E8FEE7B12F061EA8A7AB0CD4A8E683946684388498D6117AFC404847B9FBB0A16DC0E5480609B1352DF8F61457DCDBDA317248CA81082CC4F30E29A3242D3B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.N..~...~...~..r....~.v.....~..a....~...z...~...}...~...{...~.......~.......~.v.w...~.v.~...~.v.....~.v.|...~.Rich..~.........................PE..d......d.........." .........r......T.....................................................`.........................................@....T..Hr..h...............................p\..p...T.......................(......8................0...........................text............................... ..`.rdata..f...........................@..@.data...............................@....pdata...............d..............@..@.rsrc...............................@..@.reloc..p\.......^..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\VCRUNTIME140.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):109392
                                                                                                                                                                                                                            Entropy (8bit):6.641929675972235
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
                                                                                                                                                                                                                            MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
                                                                                                                                                                                                                            SHA1:489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
                                                                                                                                                                                                                            SHA-256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
                                                                                                                                                                                                                            SHA-512:D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\VCRUNTIME140_1.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):49520
                                                                                                                                                                                                                            Entropy (8bit):6.65700274508223
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
                                                                                                                                                                                                                            MD5:7E668AB8A78BD0118B94978D154C85BC
                                                                                                                                                                                                                            SHA1:DBAC42A02A8D50639805174AFD21D45F3C56E3A0
                                                                                                                                                                                                                            SHA-256:E4B533A94E02C574780E4B333FCF0889F65ED00D39E32C0FBBDA2116F185873F
                                                                                                                                                                                                                            SHA-512:72BB41DB17256141B06E2EAEB8FC65AD4ABDB65E4B5F604C82B9E7E7F60050734137D602E0F853F1A38201515655B6982F2761EE0FA77C531AA58591C95F0032
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d....J.$.........." ...".<...8.......A....................................................`A........................................0m.......m..x....................r..pO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_asyncio.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):65304
                                                                                                                                                                                                                            Entropy (8bit):6.186523609819811
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:k2icaMc907zrzE6+gTKnEzhIVOnZC7SyMx6:k2icrc4HE6+gTOEzhIVOn0j
                                                                                                                                                                                                                            MD5:CEE78DC603D57CB2117E03B2C0813D84
                                                                                                                                                                                                                            SHA1:095C98CA409E364B8755DC9CFD12E6791BF6E2B8
                                                                                                                                                                                                                            SHA-256:6306BE660D87FFB2271DD5D783EE32E735A792556E0B5BD672DC0B1C206FDADC
                                                                                                                                                                                                                            SHA-512:7258560AA557E3E211BB9580ADD604B5191C769594E17800B2793239DF45225A82CE440A6B9DCF3F2228ED84712912AFFE9BF0B70B16498489832DF2DEE33E7E
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:'T.[I..[I..[I..#...[I..'H..[I..'L..[I..'M..[I..'J..[I..&H..[I.M#H..[I..[H..[I..&D..[I..&I..[I..&...[I..&K..[I.Rich.[I.........PE..d......e.........." ...#.R..........`.....................................................`.............................................P...`...d......................../..........`w..T........................... v..@............p...............................text....P.......R.................. ..`.rdata..~J...p...L...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_bz2.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):84760
                                                                                                                                                                                                                            Entropy (8bit):6.56801864004604
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:7/Uez7qlMjca6uPZLPYMPHn3m8bhztpIVCVC7SyhJDxhy:4ezGC4TM/3RbhhpIVCVCXpy
                                                                                                                                                                                                                            MD5:28EDE9CE9484F078AC4E52592A8704C7
                                                                                                                                                                                                                            SHA1:BCF8D6FE9F42A68563B6CE964BDC615C119992D0
                                                                                                                                                                                                                            SHA-256:403E76FE18515A5EA3227CF5F919AA2F32AC3233853C9FB71627F2251C554D09
                                                                                                                                                                                                                            SHA-512:8C372F9F6C4D27F7CA9028C6034C17DEB6E98CFEF690733465C1B44BD212F363625D9C768F8E0BD4C781DDDE34EE4316256203ED18FA709D120F56DF3CCA108B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d......e.........." ...#.....^..............................................P.......U....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_cffi_backend.cp311-win_amd64.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):181248
                                                                                                                                                                                                                            Entropy (8bit):6.186854863391558
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:nmHfhrWGYV6sewRdFRId6PBNKcqDn/C1j/UyS7viSTLkKxalPu//ay/i:nmprWX6sPRNPBAn/0/dCiSTLL0P2/ay
                                                                                                                                                                                                                            MD5:210DEF84BB2C35115A2B2AC25E3FFD8F
                                                                                                                                                                                                                            SHA1:0376B275C81C25D4DF2BE4789C875B31F106BD09
                                                                                                                                                                                                                            SHA-256:59767B0918859BEDDF28A7D66A50431411FFD940C32B3E8347E6D938B60FACDF
                                                                                                                                                                                                                            SHA-512:CD5551EB7AFD4645860C7EDD7B0ABD375EE6E1DA934BE21A6099879C8EE3812D57F2398CAD28FBB6F75BBA77471D9B32C96C7C1E9D3B4D26C7FC838745746C7F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........ ..MA.CMA.CMA.CD9MCAA.C.4.BOA.C+.#CIA.C.4.BFA.C.4.BEA.C.4.BIA.C.9.BIA.C.=.BNA.CMA.C.A.C.4.BIA.CD9KCLA.C.4.BLA.C.4!CLA.C.4.BLA.CRichMA.C........................PE..d...,..e.........." .........@..............................................0............`..........................................g..l...|g..................<............ .......M...............................M..8............................................text............................... ..`.rdata..l...........................@..@.data....\.......0...v..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_ctypes.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):123672
                                                                                                                                                                                                                            Entropy (8bit):6.0601189161591
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:aS7u5LnIxdP3fPHW+QfLIrAYKpemW9IVLPjo:aSw+3FQfLIrIemW3
                                                                                                                                                                                                                            MD5:22C4892CAF560A3EE28CF7F210711F9E
                                                                                                                                                                                                                            SHA1:B30520FADD882B667ECEF3B4E5C05DC92E08B95A
                                                                                                                                                                                                                            SHA-256:E28D4E46E5D10B5FDCF0292F91E8FD767E33473116247CD5D577E4554D7A4C0C
                                                                                                                                                                                                                            SHA-512:EDB86B3694FFF0B05318DECF7FC42C20C348C1523892CCE7B89CC9C5AB62925261D4DD72D9F46C9B2BDA5AC1E6B53060B8701318B064A286E84F817813960B19
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................).....).....).....).....O...............W.......c.O.....O.....O.o...O.....Rich..........................PE..d......e.........." ...#............p\..............................................jh....`.........................................pP.......P.........................../..............T...........................`...@............................................text............................... ..`.rdata...l.......n..................@..@.data...$=...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_decimal.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):253720
                                                                                                                                                                                                                            Entropy (8bit):6.551075270762715
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:cjz3B48pj9aOtoQdpJOsoTiSi9qWM53pLW1Atp6tQh7:i94uj9afQVrom0bUQh7
                                                                                                                                                                                                                            MD5:BAAA9067639597E63B55794A757DDEFF
                                                                                                                                                                                                                            SHA1:E8DD6B03EBEF0B0A709E6CCCFF0E9F33C5142304
                                                                                                                                                                                                                            SHA-256:6CD52B65E11839F417B212BA5A39F182B0151A711EBC7629DC260B532391DB72
                                                                                                                                                                                                                            SHA-512:7995C3B818764AD88DB82148EA0CE560A0BBE9594CA333671B4C5E5C949F5932210EDBD63D4A0E0DC2DAF24737B99318E3D5DAAEE32A5478399A6AA1B9EE3719
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d......e.........." ...#.x...<......<...............................................:.....`......................................... T..P...pT..................$'......./......P.......T...........................P...@............................................text....v.......x.................. ..`.rdata..l............|..............@..@.data....*...p...$...T..............@....pdata..$'.......(...x..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_hashlib.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):65304
                                                                                                                                                                                                                            Entropy (8bit):6.2555709687934655
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:jfKlbLgy209/MkZy6n23JZlnvy7OjZophIVOIi7SyMrxZR1:7Khgy+XZla7OjSphIVOIiKR1
                                                                                                                                                                                                                            MD5:C888ECC8298C36D498FF8919CEBDB4E6
                                                                                                                                                                                                                            SHA1:F904E1832B9D9614FA1B8F23853B3E8C878D649D
                                                                                                                                                                                                                            SHA-256:21D59958E2AD1B944C4811A71E88DE08C05C5CA07945192AB93DA5065FAC8926
                                                                                                                                                                                                                            SHA-512:7161065608F34D6DE32F2C70B7485C4EE38CD3A41EF68A1BEACEE78E4C5B525D0C1347F148862CF59ABD9A4AD0026C2C2939736F4FC4C93E6393B3B53AA7C377
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(t..F'..F'..F'..'..F'u.G&..F'u.C&..F'u.B&..F'u.E&..F'..G&..F'..G&..F'..G'B.F'..K&..F'..F&..F'...'..F'..D&..F'Rich..F'................PE..d......e.........." ...#.T...~......@@..............................................H.....`............................................P... ............................/......X...P}..T............................|..@............p..0............................text....S.......T.................. ..`.rdata...O...p...P...X..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_lzma.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):159000
                                                                                                                                                                                                                            Entropy (8bit):6.849076584495919
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:cNltLBrdV/REWa/g7Lznf49mNoiUMApqlpIVZ1SXW:cNltPpREgAYOicMI
                                                                                                                                                                                                                            MD5:D386B7C4DCF589E026ABFC7196CF1C4C
                                                                                                                                                                                                                            SHA1:C07CE47CE0E69D233C5BDD0BCAC507057D04B2D4
                                                                                                                                                                                                                            SHA-256:AD0440CA6998E18F5CC917D088AF3FEA2C0FF0FEBCE2B5E2B6C0F1370F6E87B1
                                                                                                                                                                                                                            SHA-512:78D79E2379761B054DF1F9FD8C5B7DE5C16B99AF2D2DE16A3D0AC5CB3F0BD522257579A49E91218B972A273DB4981F046609FDCF2F31CF074724D544DAC7D6C8
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T"#.5Lp.5Lp.5Lp.M.p.5Lp.IMq.5Lp.IIq.5Lp.IHq.5Lp.IOq.5LpnHMq.5Lp.MMq.5Lp.5Mp.5LpnHAq.5LpnHLq.5LpnH.p.5LpnHNq.5LpRich.5Lp................PE..d......e.........." ...#.b...........5....................................................`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text...na.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_multiprocessing.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):34584
                                                                                                                                                                                                                            Entropy (8bit):6.408696570061904
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:n7I6Rwcl5w5zu8TdywGnJjRIVWtTk5YiSyvE+OAMxkEO:7Ikl5kzu8TdywGJjRIVWtTu7Sy18xK
                                                                                                                                                                                                                            MD5:622A0E73779C88FC430B69CAF4A39789
                                                                                                                                                                                                                            SHA1:F6536137E4E2CD8EC181F09B7DBA5E2E4D03B392
                                                                                                                                                                                                                            SHA-256:EDFA9EE414F41448F8FFABB79F3BB8DB5C25E1CFD28FACF88EB5FE2D1E1D7551
                                                                                                                                                                                                                            SHA-512:FD8D6DB53B630821845DFE22B09C4335565F848A421AF271797EFE272BAAA1EF887D735D4D5CD7D1258F2DD8F523327A67C071F7D16FC1BF53ACA39BAE41DFF2
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-*.yCy.yCy.yCy...y.yCy'.Bx.yCy'.Fx.yCy'.Gx.yCy'.@x.yCyA.Bx.yCy.yBy.yCy..Bx.yCyA.Nx.yCyA.Cx.yCyA..y.yCyA.Ax.yCyRich.yCy................PE..d......e.........." ...#.....<......0...............................................E.....`.........................................0D..`....D..x....p.......`.......X.../...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_overlapped.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):50968
                                                                                                                                                                                                                            Entropy (8bit):6.434106091606417
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:R1FMCcP4W9vqJKRJs2lNXSkCirb1IVXtW5YiSyvw5AMxkEfEk:R1FMaJKWkCg1IVXts7Sy4hxjEk
                                                                                                                                                                                                                            MD5:D3BE208DC5388225162B6F88FF1D4386
                                                                                                                                                                                                                            SHA1:8EFFDB606B6771D5FDF83145DE0F289E8AD83B69
                                                                                                                                                                                                                            SHA-256:CE48969EBEBDC620F4313EBA2A6B6CDA568B663C09D5478FA93826D401ABE674
                                                                                                                                                                                                                            SHA-512:9E1C3B37E51616687EECF1F7B945003F6EB4291D8794FEA5545B4A84C636007EB781C18F6436039DF02A902223AC73EFAC9B2E44DDC8594DB62FEB9997475DA3
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}!{..O(..O(..O(.d.(..O(W`N)..O(W`J)..O(W`K)..O(W`L)..O(1aN)..O(..N(..O(.dN)..O(.dK)..O(1aB)..O(1aO)..O(1a.(..O(1aM)..O(Rich..O(................PE..d......e.........." ...#.B...X.......................................................N....`.........................................0...X................................/......,....f..T...........................Pe..@............`...............................text...fA.......B.................. ..`.rdata..$5...`...6...F..............@..@.data................|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_queue.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):32536
                                                                                                                                                                                                                            Entropy (8bit):6.447318282610391
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:P0+yFg6rXtUmxU99IVQUT5YiSyvyxAMxkE44:c+wRXiWU99IVQUd7Sy+xE4
                                                                                                                                                                                                                            MD5:50842CE7FCB1950B672D8A31C892A5D1
                                                                                                                                                                                                                            SHA1:D84C69FA2110B860DA71785D1DBE868BD1A8320F
                                                                                                                                                                                                                            SHA-256:06C36EC0749D041E6957C3CD7D2D510628B6ABE28CEE8C9728412D9CE196A8A2
                                                                                                                                                                                                                            SHA-512:C1E686C112B55AB0A5E639399BD6C1D7ADFE6AEDC847F07C708BEE9F6F2876A1D8F41EDE9D5E5A88AC8A9FBB9F1029A93A83D1126619874E33D09C5A5E45A50D
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:WX.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.L[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........PE..d......e.........." ...#.....8......................................................(F....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..0............................text............................... ..`.rdata..R....0......................@..@.data...x....P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_socket.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):79640
                                                                                                                                                                                                                            Entropy (8bit):6.28999572337647
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:YJlhpHrTT9r3ujE9/s+S+pzpCoiTFVf7p9IVLwg7SyLxU:Y7hpL13ujE9/sT+pz4oYFVTp9IVLwgo
                                                                                                                                                                                                                            MD5:2C0EC225E35A0377AC1D0777631BFFE4
                                                                                                                                                                                                                            SHA1:7E5D81A06FF8317AF52284AEDCCAC6EBACE5C390
                                                                                                                                                                                                                            SHA-256:301C47C4016DAC27811F04F4D7232F24852EF7675E9A4500F0601703ED8F06AF
                                                                                                                                                                                                                            SHA-512:AEA9D34D9E93622B01E702DEFD437D397F0E7642BC5F9829754D59860B345BBDE2DD6D7FE21CC1D0397FF0A9DB4ECFE7C38B649D33C5C6F0EAD233CB201A73E0
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.+.".E.".E.".E.+...$.E...D. .E...@./.E...A.*.E...F.!.E...D. .E.".D...E.i.D.%.E...H.#.E...E.#.E....#.E...G.#.E.Rich".E.........................PE..d......e.........." ...#.l...........%.......................................P............`.............................................P............0....... ..x......../...@..........T...............................@............................................text...6k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_sqlite3.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):120088
                                                                                                                                                                                                                            Entropy (8bit):6.2579260754206505
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:vvtiqaiN2oSNMAwwi3CLl147ZvV9NdrRvdO5yFAuaUVMJF8MYRnchIVOQ1B:HJaiN2oSNVDD5FJFr2
                                                                                                                                                                                                                            MD5:A70731AE2CA44B7292623AE8B0281549
                                                                                                                                                                                                                            SHA1:9E086C0753BB43E2876C33C4872E71808932A744
                                                                                                                                                                                                                            SHA-256:55344349F9199AEDAD1737A0311CBE2C3A4BF9494B76982520BACAD90F463C1B
                                                                                                                                                                                                                            SHA-512:8334104DF9837D32946965290BBC46BA0A0ADA17BD2D03FC63380979F5FC86B26BE245636718B4304DFD0D85A5B3F7170614F148E5C965CC5ADF59D34465F7F1
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`.g...g...g.......g.......g.....g.......g.......g.......g..q....g.......g...g...f..q....g..q....g..q..g..q....g..Rich.g..........................PE..d......e.........." ...#............................................................ G....`..........................................Z..P....Z.........................../..............T...........................p...@............................................text............................... ..`.rdata..l...........................@..@.data................n..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_ssl.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):176920
                                                                                                                                                                                                                            Entropy (8bit):5.955624236034285
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:pjIQQSFBfL+SiSVWuXa6XzfBJ9d41Olh59YL48PMrN/WgAlNcLpIVC72a:CSFNL3LJa6Xzj4BLcLP
                                                                                                                                                                                                                            MD5:66E78727C2DA15FD2AAC56571CD57147
                                                                                                                                                                                                                            SHA1:E93C9A5E61DB000DEE0D921F55F8507539D2DF3D
                                                                                                                                                                                                                            SHA-256:4727B60962EFACFD742DCA21341A884160CF9FCF499B9AFA3D9FDBCC93FB75D0
                                                                                                                                                                                                                            SHA-512:A6881F9F5827ACEB51957AAED4C53B69FCF836F60B9FC66EEB2ED84AED08437A9F0B35EA038D4B1E3C539E350D9D343F8A6782B017B10A2A5157649ABBCA9F9A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.+.4.x.4.x.4.x.L)x.4.x.H.y.4.x.H.y.4.x.H.y.4.x.H.y.4.xiI.y.4.x.4.x>5.x.L.y.4.xiI.y.4.xiI.y.4.xiIEx.4.xiI.y.4.xRich.4.x................PE..d......e.........." ...#............l+...............................................!....`.........................................0...d................................/......|...P...T...............................@............................................text............................... ..`.rdata...".......$..................@..@.data...............................@....pdata...............\..............@..@.rsrc................h..............@..@.reloc..|............r..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\_uuid.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):25368
                                                                                                                                                                                                                            Entropy (8bit):6.628339287223099
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:lCfwFpEWjfivQpIVZwobHQIYiSy1pCQFjzuAM+o/8E9VF0NySoJ:4qpEI4QpIVZwg5YiSyvgAMxkE7
                                                                                                                                                                                                                            MD5:3A09B6DB7E4D6FF0F74C292649E4BA96
                                                                                                                                                                                                                            SHA1:1A515F98946A4DCCC50579CBCEDF959017F3A23C
                                                                                                                                                                                                                            SHA-256:FC09E40E569F472DD4BA2EA93DA48220A6B0387EC62BB0F41F13EF8FAB215413
                                                                                                                                                                                                                            SHA-512:8D5EA9F7EEE3D75F0673CC7821A94C50F753299128F3D623E7A9C262788C91C267827C859C5D46314A42310C27699AF5CDFC6F7821DD38BF03C0B35873D9730F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<p.R#.R#.R#...#.R#i.S".R#i.W".R#i.V".R#i.Q".R#..S".R#..S".R#.S#..R#..Z".R#..R".R#...#.R#..P".R#Rich.R#........................PE..d......e.........." ...#.....&...... ........................................p............`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-console-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12240
                                                                                                                                                                                                                            Entropy (8bit):6.608323768366966
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:KFOWWthWzWf9BvVVWQ4mWqyVT/gqnajKsrCS81:uZWthWeN01IlGsrCt
                                                                                                                                                                                                                            MD5:07EBE4D5CEF3301CCF07430F4C3E32D8
                                                                                                                                                                                                                            SHA1:3B878B2B2720915773F16DBA6D493DAB0680AC5F
                                                                                                                                                                                                                            SHA-256:8F8B79150E850ACC92FD6AAB614F6E3759BEA875134A62087D5DD65581E3001F
                                                                                                                                                                                                                            SHA-512:6C7E4DF62EBAE9934B698F231CF51F54743CF3303CD758573D00F872B8ECC2AF1F556B094503AAE91100189C0D0A93EAF1B7CAFEC677F384A1D7B4FDA2EEE598
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0............`A........................................p...,............ ...................!..............p............................................................................rdata..d...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11736
                                                                                                                                                                                                                            Entropy (8bit):6.6074868843808785
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:PUWthW6Wf9BvVVWQ4SWZifvXqnajJ6HNbLet:MWthW3NhXll6HZm
                                                                                                                                                                                                                            MD5:557405C47613DE66B111D0E2B01F2FDB
                                                                                                                                                                                                                            SHA1:DE116ED5DE1FFAA900732709E5E4EEF921EAD63C
                                                                                                                                                                                                                            SHA-256:913EAAA7997A6AEE53574CFFB83F9C9C1700B1D8B46744A5E12D76A1E53376FD
                                                                                                                                                                                                                            SHA-512:C2B326F555B2B7ACB7849402AC85922880105857C616EF98F7FB4BBBDC2CD7F2AF010F4A747875646FCC272AB8AA4CE290B6E09A9896CE1587E638502BD4BEFB
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...p.~..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11728
                                                                                                                                                                                                                            Entropy (8bit):6.622854484071805
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
                                                                                                                                                                                                                            MD5:624401F31A706B1AE2245EB19264DC7F
                                                                                                                                                                                                                            SHA1:8D9DEF3750C18DDFC044D5568E3406D5D0FB9285
                                                                                                                                                                                                                            SHA-256:58A8D69DF60ECBEE776CD9A74B2A32B14BF2B0BD92D527EC5F19502A0D3EB8E9
                                                                                                                                                                                                                            SHA-512:3353734B556D6EEBC57734827450CE3B34D010E0C033E95A6E60800C0FDA79A1958EBF9053F12054026525D95D24EEC541633186F00F162475CEC19F07A0D817
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...YJ..........." .........................................................0.......s....`A........................................p................ ...................!..............p............................................................................rdata..T...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11728
                                                                                                                                                                                                                            Entropy (8bit):6.670771733256744
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
                                                                                                                                                                                                                            MD5:2DB5666D3600A4ABCE86BE0099C6B881
                                                                                                                                                                                                                            SHA1:63D5DDA4CEC0076884BC678C691BDD2A4FA1D906
                                                                                                                                                                                                                            SHA-256:46079C0A1B660FC187AAFD760707F369D0B60D424D878C57685545A3FCE95819
                                                                                                                                                                                                                            SHA-512:7C6E1E022DB4217A85A4012C8E4DAEE0A0F987E4FBA8A4C952424EF28E250BAC38B088C242D72B4641157B7CC882161AEFA177765A2E23AFCDC627188A084345
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....^[..........." .........................................................0......@^....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15328
                                                                                                                                                                                                                            Entropy (8bit):6.561472518225768
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:RaNYPvVX8rFTsoWthWgWf9BvVVWQ4SWfMaPOoI80Hy5qnajslBE87QyX:HPvVXqWthWlN2WlslEE87Qw
                                                                                                                                                                                                                            MD5:0F7D418C05128246AFA335A1FB400CB9
                                                                                                                                                                                                                            SHA1:F6313E371ED5A1DFFE35815CC5D25981184D0368
                                                                                                                                                                                                                            SHA-256:5C9BC70586AD538B0DF1FCF5D6F1F3527450AE16935AA34BD7EB494B4F1B2DB9
                                                                                                                                                                                                                            SHA-512:7555D9D3311C8622DF6782748C2186A3738C4807FC58DF2F75E539729FC4069DB23739F391950303F12E0D25DF9F065B4C52E13B2EBB6D417CA4C12CFDECA631
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...*.;A.........." .........................................................@.......m....`A........................................p................0...................!..............p............................................................................rdata..<...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l1-2-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11728
                                                                                                                                                                                                                            Entropy (8bit):6.638884356866373
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:jlWaWthWAWf9BvVVWQ4WWloprVP+CjAWqnajKsNWqL:jIaWthWFNxtVP+CcWlGsNxL
                                                                                                                                                                                                                            MD5:5A72A803DF2B425D5AAFF21F0F064011
                                                                                                                                                                                                                            SHA1:4B31963D981C07A7AB2A0D1A706067C539C55EC5
                                                                                                                                                                                                                            SHA-256:629E52BA4E2DCA91B10EF7729A1722888E01284EED7DDA6030D0A1EC46C94086
                                                                                                                                                                                                                            SHA-512:BF44997C405C2BA80100EB0F2FF7304938FC69E4D7AE3EAC52B3C236C3188E80C9F18BDA226B5F4FDE0112320E74C198AD985F9FFD7CEA99ACA22980C39C7F69
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...=+vj.........." .........................................................0.......N....`A........................................p...L............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-file-l2-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11744
                                                                                                                                                                                                                            Entropy (8bit):6.744400973311854
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:imdzvQzEWthWwMVDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN5DEs3r:v3WthWyWf9BvVVWQ4SWVVFJqqnajW2y
                                                                                                                                                                                                                            MD5:721B60B85094851C06D572F0BD5D88CD
                                                                                                                                                                                                                            SHA1:4D0EE4D717AEB9C35DA8621A545D3E2B9F19B4E7
                                                                                                                                                                                                                            SHA-256:DAC867476CAA42FF8DF8F5DFE869FFD56A18DADEE17D47889AFB69ED6519AFBF
                                                                                                                                                                                                                            SHA-512:430A91FCECDE4C8CC4AC7EB9B4C6619243AB244EE88C34C9E93CA918E54BD42B08ACA8EA4475D4C0F5FA95241E4AACB3206CBAE863E92D15528C8E7C9F45601B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......T`....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11736
                                                                                                                                                                                                                            Entropy (8bit):6.638488013343178
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:frWthWFWf9BvVVWQ4SWNOfvXqnajJ6H4WJ:frWthWANRXll6H4WJ
                                                                                                                                                                                                                            MD5:D1DF480505F2D23C0B5C53DF2E0E2A1A
                                                                                                                                                                                                                            SHA1:207DB9568AFD273E864B05C87282987E7E81D0BA
                                                                                                                                                                                                                            SHA-256:0B3DFB8554EAD94D5DA7859A12DB353942406F9D1DFE3FAC3D48663C233EA99D
                                                                                                                                                                                                                            SHA-512:F14239420F5DD84A15FF5FCA2FAD81D0AA9280C566FA581122A018E10EBDF308AC0BF1D3FCFC08634C1058C395C767130C5ABCA55540295C68DF24FFD931CA0A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....(..........." .........................................................0......;.....`A........................................p...`............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12256
                                                                                                                                                                                                                            Entropy (8bit):6.588267640761022
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
                                                                                                                                                                                                                            MD5:73433EBFC9A47ED16EA544DDD308EAF8
                                                                                                                                                                                                                            SHA1:AC1DA1378DD79762C6619C9A63FD1EBE4D360C6F
                                                                                                                                                                                                                            SHA-256:C43075B1D2386A8A262DE628C93A65350E52EAE82582B27F879708364B978E29
                                                                                                                                                                                                                            SHA-512:1C28CC0D3D02D4C308A86E9D0BC2DA88333DFA8C92305EC706F3E389F7BB6D15053040AFD1C4F0AA3383F3549495343A537D09FE882DB6ED12B7507115E5A263
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....pi..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..<...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-interlocked-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11728
                                                                                                                                                                                                                            Entropy (8bit):6.678828474114903
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:4TWthWckWf9BvVVWQ4mWQAyUD7DiqnajKswzjdg:4TWthWcRNqGlGswzji
                                                                                                                                                                                                                            MD5:7C7B61FFA29209B13D2506418746780B
                                                                                                                                                                                                                            SHA1:08F3A819B5229734D98D58291BE4BFA0BEC8F761
                                                                                                                                                                                                                            SHA-256:C23FE8D5C3CA89189D11EC8DF983CC144D168CB54D9EAB5D9532767BCB2F1FA3
                                                                                                                                                                                                                            SHA-512:6E5E3485D980E7E2824665CBFE4F1619B3E61CE3BCBF103979532E2B1C3D22C89F65BCFBDDBB5FE88CDDD096F8FD72D498E8EE35C3C2307BACECC6DEBBC1C97F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....|............" .........................................................0.......3....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12752
                                                                                                                                                                                                                            Entropy (8bit):6.602852377056617
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
                                                                                                                                                                                                                            MD5:6D0550D3A64BD3FD1D1B739133EFB133
                                                                                                                                                                                                                            SHA1:C7596FDE7EA1C676F0CC679CED8BA810D15A4AFE
                                                                                                                                                                                                                            SHA-256:F320F9C0463DE641B396CE7561AF995DE32211E144407828B117088CF289DF91
                                                                                                                                                                                                                            SHA-512:5DA9D490EF54A1129C94CE51349399B9012FC0D4B575AE6C9F1BAFCFCF7F65266F797C539489F882D4AD924C94428B72F5137009A851ECB541FE7FB9DE12FEB2
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...]. ,.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..X...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-localization-l1-2-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14800
                                                                                                                                                                                                                            Entropy (8bit):6.528059454770997
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:On2OMw3zdp3bwjGfue9/0jCRrndbZWWthWdNHhfVlGsSH:/OMwBprwjGfue9/0jCRrndbLEKv
                                                                                                                                                                                                                            MD5:1ED0B196AB58EDB58FCF84E1739C63CE
                                                                                                                                                                                                                            SHA1:AC7D6C77629BDEE1DF7E380CC9559E09D51D75B7
                                                                                                                                                                                                                            SHA-256:8664222823E122FCA724620FD8B72187FC5336C737D891D3CEF85F4F533B8DE2
                                                                                                                                                                                                                            SHA-512:E1FA7F14F39C97AAA3104F3E13098626B5F7CFD665BA52DCB2312A329639AAF5083A9177E4686D11C4213E28ACC40E2C027988074B6CC13C5016D5C5E9EF897B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...w............" .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-memory-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12240
                                                                                                                                                                                                                            Entropy (8bit):6.659218747104705
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:2E+tWthWvWf9BvVVWQ4mWxHD7DiqnajKswzGIAf:T+tWthWiNcGlGswzLAf
                                                                                                                                                                                                                            MD5:721BAEA26A27134792C5CCC613F212B2
                                                                                                                                                                                                                            SHA1:2A27DCD2436DF656A8264A949D9CE00EAB4E35E8
                                                                                                                                                                                                                            SHA-256:5D9767D8CCA0FBFD5801BFF2E0C2ADDDD1BAAAA8175543625609ABCE1A9257BD
                                                                                                                                                                                                                            SHA-512:9FD6058407AA95058ED2FDA9D391B7A35FA99395EC719B83C5116E91C9B448A6D853ECC731D0BDF448D1436382EECC1FA9101F73FA242D826CC13C4FD881D9BD
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...,OT..........." .........................................................0...........`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11728
                                                                                                                                                                                                                            Entropy (8bit):6.739082809754283
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:vdWthW8Wf9BvVVWQ4mWG2P+CjAWqnajKsNt:lWthWJNUP+CcWlGsNt
                                                                                                                                                                                                                            MD5:B3F887142F40CB176B59E58458F8C46D
                                                                                                                                                                                                                            SHA1:A05948ABA6F58EB99BBAC54FA3ED0338D40CBFAD
                                                                                                                                                                                                                            SHA-256:8E015CDF2561450ED9A0773BE1159463163C19EAB2B6976155117D16C36519DA
                                                                                                                                                                                                                            SHA-512:7B762319EC58E3FCB84B215AE142699B766FA9D5A26E1A727572EE6ED4F5D19C859EFB568C0268846B4AA5506422D6DD9B4854DA2C9B419BFEC754F547203F7E
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...X.j..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12752
                                                                                                                                                                                                                            Entropy (8bit):6.601112204637961
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:GFPWthW5Wf9BvVVWQ4mWc0ZD7DiqnajKswzczr:GFPWthWsNiGlGswzq
                                                                                                                                                                                                                            MD5:89F35CB1212A1FD8FBE960795C92D6E8
                                                                                                                                                                                                                            SHA1:061AE273A75324885DD098EE1FF4246A97E1E60C
                                                                                                                                                                                                                            SHA-256:058EB7CE88C22D2FF7D3E61E6593CA4E3D6DF449F984BF251D9432665E1517D1
                                                                                                                                                                                                                            SHA-512:F9E81F1FEAB1535128B16E9FF389BD3DAAAB8D1DABF64270F9E563BE9D370C023DE5D5306DD0DE6D27A5A099E7C073D17499442F058EC1D20B9D37F56BCFE6D2
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...ig............" .........................................................0......H.....`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processthreads-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14288
                                                                                                                                                                                                                            Entropy (8bit):6.521808801015781
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
                                                                                                                                                                                                                            MD5:0C933A4B3C2FCF1F805EDD849428C732
                                                                                                                                                                                                                            SHA1:B8B19318DBB1D2B7D262527ABD1468D099DE3FB6
                                                                                                                                                                                                                            SHA-256:A5B733E3DCE21AB62BD4010F151B3578C6F1246DA4A96D51AC60817865648DD3
                                                                                                                                                                                                                            SHA-512:B25ED54345A5B14E06AA9DADD07B465C14C23225023D7225E04FBD8A439E184A7D43AB40DF80E3F8A3C0F2D5C7A79B402DDC6B9093D0D798E612F4406284E39D
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....U..........." .........................................................0......Y.....`A........................................p................ ...................!..............p............................................................................rdata..4...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-processthreads-l1-1-1.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12240
                                                                                                                                                                                                                            Entropy (8bit):6.671157737548847
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:7oDfIeVWthWZWf9BvVVWQ4mWaHvP+CjAWqnajKsNZ:7oDfIeVWthWMNVP+CcWlGsNZ
                                                                                                                                                                                                                            MD5:7E8B61D27A9D04E28D4DAE0BFA0902ED
                                                                                                                                                                                                                            SHA1:861A7B31022915F26FB49C79AC357C65782C9F4B
                                                                                                                                                                                                                            SHA-256:1EF06C600C451E66E744B2CA356B7F4B7B88BA2F52EC7795858D21525848AC8C
                                                                                                                                                                                                                            SHA-512:1C5B35026937B45BEB76CB8D79334A306342C57A8E36CC15D633458582FC8F7D9AB70ACE7A92144288C6C017F33ECFC20477A04432619B40A21C9CDA8D249F6D
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......N.....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-profile-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11728
                                                                                                                                                                                                                            Entropy (8bit):6.599056003106114
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:gR7WthWTVWf9BvVVWQ4mWg2a5P+CjAWqnajKsNQbWl:gVWthWkN/P+CcWlGsNMg
                                                                                                                                                                                                                            MD5:8D12FFD920314B71F2C32614CC124FEC
                                                                                                                                                                                                                            SHA1:251A98F2C75C2E25FFD0580F90657A3EA7895F30
                                                                                                                                                                                                                            SHA-256:E63550608DD58040304EA85367E9E0722038BA8E7DC7BF9D91C4D84F0EC65887
                                                                                                                                                                                                                            SHA-512:5084C739D7DE465A9A78BCDBB8A3BD063B84A68DCFD3C9EF1BFA224C1CC06580E2A2523FD4696CFC48E9FD068A2C44DBC794DD9BDB43DC74B4E854C82ECD3EA5
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....X4.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12240
                                                                                                                                                                                                                            Entropy (8bit):6.602527553095181
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
                                                                                                                                                                                                                            MD5:9FA3FC24186D912B0694A572847D6D74
                                                                                                                                                                                                                            SHA1:93184E00CBDDACAB7F2AD78447D0EAC1B764114D
                                                                                                                                                                                                                            SHA-256:91508AB353B90B30FF2551020E9755D7AB0E860308F16C2F6417DFB2E9A75014
                                                                                                                                                                                                                            SHA-512:95AD31C9082F57EA57F5B4C605331FCAD62735A1862AFB01EF8A67FEA4E450154C1AE0C411CF3AC5B9CD35741F8100409CC1910F69C1B2D807D252389812F594
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....P..........." .........................................................0.......`....`A........................................p................ ...................!..............p............................................................................rdata..P...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-string-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11728
                                                                                                                                                                                                                            Entropy (8bit):6.6806369134652055
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
                                                                                                                                                                                                                            MD5:C9CBAD5632D4D42A1BC25CCFA8833601
                                                                                                                                                                                                                            SHA1:09F37353A89F1BFE49F7508559DA2922B8EFEB05
                                                                                                                                                                                                                            SHA-256:F3A7A9C98EBE915B1B57C16E27FFFD4DDF31A82F0F21C06FE292878E48F5883E
                                                                                                                                                                                                                            SHA-512:2412E0AFFDC6DB069DE7BD9666B7BAA1CD76AA8D976C9649A4C2F1FFCE27F8269C9B02DA5FD486EC86B54231B1A5EBF6A1C72790815B7C253FEE1F211086892F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....E.=.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..,...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13776
                                                                                                                                                                                                                            Entropy (8bit):6.573983778839785
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
                                                                                                                                                                                                                            MD5:4CCDE2D1681217E282996E27F3D9ED2E
                                                                                                                                                                                                                            SHA1:8EDA134B0294ED35E4BBAC4911DA620301A3F34D
                                                                                                                                                                                                                            SHA-256:D6708D1254ED88A948871771D6D1296945E1AA3AEB7E33E16CC378F396C61045
                                                                                                                                                                                                                            SHA-512:93FE6AE9A947AC88CC5ED78996E555700340E110D12B2651F11956DB7CEE66322C269717D31FCCB31744F4C572A455B156B368F08B70EDA9EFFEC6DE01DBAB23
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....k,..........." .........................................................0......3.....`A........................................p...X............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12240
                                                                                                                                                                                                                            Entropy (8bit):6.7137872023984055
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
                                                                                                                                                                                                                            MD5:E86CFC5E1147C25972A5EEFED7BE989F
                                                                                                                                                                                                                            SHA1:0075091C0B1F2809393C5B8B5921586BDD389B29
                                                                                                                                                                                                                            SHA-256:72C639D1AFDA32A65143BCBE016FE5D8B46D17924F5F5190EB04EFE954C1199A
                                                                                                                                                                                                                            SHA-512:EA58A8D5AA587B7F5BDE74B4D394921902412617100ED161A7E0BEF6B3C91C5DAE657065EA7805A152DD76992997017E070F5415EF120812B0D61A401AA8C110
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...jN/..........." .........................................................0............`A........................................p...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12768
                                                                                                                                                                                                                            Entropy (8bit):6.614330511483598
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
                                                                                                                                                                                                                            MD5:206ADCB409A1C9A026F7AFDFC2933202
                                                                                                                                                                                                                            SHA1:BB67E1232A536A4D1AE63370BD1A9B5431335E77
                                                                                                                                                                                                                            SHA-256:76D8E4ED946DEEFEEFA0D0012C276F0B61F3D1C84AF00533F4931546CBB2F99E
                                                                                                                                                                                                                            SHA-512:727AA0C4CD1A0B7E2AFFDCED5DA3A0E898E9BAE3C731FF804406AD13864CEE2B27E5BAAC653BAB9A0D2D961489915D4FCAD18557D4383ECB0A066902276955A7
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....~y..........." .........................................................0............`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12240
                                                                                                                                                                                                                            Entropy (8bit):6.704366348384627
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
                                                                                                                                                                                                                            MD5:91A2AE3C4EB79CF748E15A58108409AD
                                                                                                                                                                                                                            SHA1:D402B9DF99723EA26A141BFC640D78EAF0B0111B
                                                                                                                                                                                                                            SHA-256:B0EDA99EABD32FEFECC478FD9FE7439A3F646A864FDAB4EC3C1F18574B5F8B34
                                                                                                                                                                                                                            SHA-512:8527AF610C1E2101B6F336A142B1A85AC9C19BB3AF4AD4A245CFB6FD602DC185DA0F7803358067099475102F3A8F10A834DC75B56D3E6DED2ED833C00AD217ED
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....%j.........." .........................................................0......|B....`A........................................p...P............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-core-util-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11728
                                                                                                                                                                                                                            Entropy (8bit):6.623077637622405
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
                                                                                                                                                                                                                            MD5:1E4C4C8E643DE249401E954488744997
                                                                                                                                                                                                                            SHA1:DB1C4C0FC907100F204B21474E8CD2DB0135BC61
                                                                                                                                                                                                                            SHA-256:F28A8FE2CD7E8E00B6D2EC273C16DB6E6EEA9B6B16F7F69887154B6228AF981E
                                                                                                                                                                                                                            SHA-512:EF8411FD321C0E363C2E5742312CC566E616D4B0A65EFF4FB6F1B22FDBEA3410E1D75B99E889939FF70AD4629C84CEDC88F6794896428C5F0355143443FDC3A3
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....R..........." .........................................................0............`A........................................p...<............ ...................!..............p............................................................................rdata..p...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12752
                                                                                                                                                                                                                            Entropy (8bit):6.643812426159955
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
                                                                                                                                                                                                                            MD5:FA770BCD70208A479BDE8086D02C22DA
                                                                                                                                                                                                                            SHA1:28EE5F3CE3732A55CA60AEE781212F117C6F3B26
                                                                                                                                                                                                                            SHA-256:E677497C1BAEFFFB33A17D22A99B76B7FA7AE7A0C84E12FDA27D9BE5C3D104CF
                                                                                                                                                                                                                            SHA-512:F8D81E350CEBDBA5AFB579A072BAD7986691E9F3D4C9FEBCA8756B807301782EE6EB5BA16B045CFA29B6E4F4696E0554C718D36D4E64431F46D1E4B1F42DC2B8
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................" .........................................................0......l.....`A........................................P................ ...................!..............p............................................................................rdata..@...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-convert-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15824
                                                                                                                                                                                                                            Entropy (8bit):6.438848882089563
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
                                                                                                                                                                                                                            MD5:4EC4790281017E616AF632DA1DC624E1
                                                                                                                                                                                                                            SHA1:342B15C5D3E34AB4AC0B9904B95D0D5B074447B7
                                                                                                                                                                                                                            SHA-256:5CF5BBB861608131B5F560CBF34A3292C80886B7C75357ACC779E0BF98E16639
                                                                                                                                                                                                                            SHA-512:80C4E20D37EFF29C7577B2D0ED67539A9C2C228EDB48AB05D72648A6ED38F5FF537715C130342BEB0E3EF16EB11179B9B484303354A026BDA3A86D5414D24E69
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....P............" .........................................................@............`A........................................P................0...................!..............p............................................................................rdata..>...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12240
                                                                                                                                                                                                                            Entropy (8bit):6.6061629057490245
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
                                                                                                                                                                                                                            MD5:7A859E91FDCF78A584AC93AA85371BC9
                                                                                                                                                                                                                            SHA1:1FA9D9CAD7CC26808E697373C1F5F32AAF59D6B7
                                                                                                                                                                                                                            SHA-256:B7EE468F5B6C650DADA7DB3AD9E115A0E97135B3DF095C3220DFD22BA277B607
                                                                                                                                                                                                                            SHA-512:A368F21ECA765AFCA86E03D59CF953500770F4A5BFF8B86B2AC53F1B5174C627E061CE9A1F781DC56506774E0D0B09725E9698D4DC2D3A59E93DA7EF3D900887
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...t............." .........................................................0......H.....`A........................................P..."............ ...................!..............p............................................................................rdata..r...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):13776
                                                                                                                                                                                                                            Entropy (8bit):6.65347762698107
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
                                                                                                                                                                                                                            MD5:972544ADE7E32BFDEB28B39BC734CDEE
                                                                                                                                                                                                                            SHA1:87816F4AFABBDEC0EC2CFEB417748398505C5AA9
                                                                                                                                                                                                                            SHA-256:7102F8D9D0F3F689129D7FE071B234077FBA4DD3687071D1E2AEAA137B123F86
                                                                                                                                                                                                                            SHA-512:5E1131B405E0C7A255B1C51073AFF99E2D5C0D28FD3E55CABC04D463758A575A954008EA1BA5B4E2B345B49AF448B93AD21DFC4A01573B3CB6E7256D9ECCEEF1
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...1............" .........................................................0......':....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12752
                                                                                                                                                                                                                            Entropy (8bit):6.58394079658593
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
                                                                                                                                                                                                                            MD5:8906279245F7385B189A6B0B67DF2D7C
                                                                                                                                                                                                                            SHA1:FCF03D9043A2DAAFE8E28DEE0B130513677227E4
                                                                                                                                                                                                                            SHA-256:F5183B8D7462C01031992267FE85680AB9C5B279BEDC0B25AB219F7C2184766F
                                                                                                                                                                                                                            SHA-512:67CAC89AE58CC715976107F3BDF279B1E78945AFD07E6F657E076D78E92EE1A98E3E7B8FEAE295AF5CE35E00C804F3F53A890895BADB1EED32377D85C21672B9
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0.......l....`A........................................P................ ...................!..............p............................................................................rdata..f...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-locale-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12240
                                                                                                                                                                                                                            Entropy (8bit):6.696904963591775
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
                                                                                                                                                                                                                            MD5:DD8176E132EEDEA3322443046AC35CA2
                                                                                                                                                                                                                            SHA1:D13587C7CC52B2C6FBCAA548C8ED2C771A260769
                                                                                                                                                                                                                            SHA-256:2EB96422375F1A7B687115B132A4005D2E7D3D5DC091FB0EB22A6471E712848E
                                                                                                                                                                                                                            SHA-512:77CB8C44C8CC8DD29997FBA4424407579AC91176482DB3CF7BC37E1F9F6AA4C4F5BA14862D2F3A9C05D1FDD7CA5A043B5F566BD0E9A9E1ED837DA9C11803B253
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...r..[.........." .........................................................0.......P....`A........................................P...e............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-math-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):20944
                                                                                                                                                                                                                            Entropy (8bit):6.216554714002396
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
                                                                                                                                                                                                                            MD5:A6A3D6D11D623E16866F38185853FACD
                                                                                                                                                                                                                            SHA1:FBEADD1E9016908ECCE5753DE1D435D6FCF3D0B5
                                                                                                                                                                                                                            SHA-256:A768339F0B03674735404248A039EC8591FCBA6FF61A3C6812414537BADD23B0
                                                                                                                                                                                                                            SHA-512:ABBF32CEB35E5EC6C1562F9F3B2652B96B7DBD97BFC08D918F987C0EC0503E8390DD697476B2A2389F0172CD8CF16029FD2EC5F32A9BA3688BF2EBEEFB081B2C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........,...............................................P............`A........................................P....%...........@...............0...!..............p............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-multibyte-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):19920
                                                                                                                                                                                                                            Entropy (8bit):6.194200929301547
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:8A/kPLPmIHJI6/CpG3t2G3t4odXLRWthW/N5GlGswz3:3/kjPmIHJI6manp3
                                                                                                                                                                                                                            MD5:B5C8AF5BADCDEFD8812AF4F63364FE2B
                                                                                                                                                                                                                            SHA1:750678935010A83E2D83769445F0D249E4568A8D
                                                                                                                                                                                                                            SHA-256:7101B3DFF525EA47B7A40DD96544C944AE400447DF7A6ACD07363B6D7968B889
                                                                                                                                                                                                                            SHA-512:A2A8D08D658F5ED368F9FB556BFB13B897F31E9540BFDFFF6567826614D6C5F0D64BD08FEC66C63E74D852AB6B083294E187507E83F2BC284DFB7CA5C86AE047
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......:.........." .........(...............................................P......uM....`A........................................P.... ...........@...............,...!..............p............................................................................rdata..D".......$..................@..@.rsrc........@.......(..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-process-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12752
                                                                                                                                                                                                                            Entropy (8bit):6.604643094751227
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1
                                                                                                                                                                                                                            MD5:074B81A625FB68159431BB556D28FAB5
                                                                                                                                                                                                                            SHA1:20F8EAD66D548CFA861BC366BB1250CED165BE24
                                                                                                                                                                                                                            SHA-256:3AF38920E767BD9EBC08F88EAF2D08C748A267C7EC60EAB41C49B3F282A4CF65
                                                                                                                                                                                                                            SHA-512:36388C3EFFA0D94CF626DECAA1DA427801CC5607A2106ABDADF92252C6F6FD2CE5BF0802F5D0A4245A1FFDB4481464C99D60510CF95E83EBAF17BD3D6ACBC3DC
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....u..........." .........................................................0............`A........................................P...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-runtime-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):16336
                                                                                                                                                                                                                            Entropy (8bit):6.449023660091811
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK
                                                                                                                                                                                                                            MD5:F1A23C251FCBB7041496352EC9BCFFBE
                                                                                                                                                                                                                            SHA1:BE4A00642EC82465BC7B3D0CC07D4E8DF72094E8
                                                                                                                                                                                                                            SHA-256:D899C2F061952B3B97AB9CDBCA2450290B0F005909DDD243ED0F4C511D32C198
                                                                                                                                                                                                                            SHA-512:31F8C5CD3B6E153073E2E2EDF0CA8072D0F787784F1611A57219349C1D57D6798A3ADBD6942B0F16CEF781634DD8691A5EC0B506DF21B24CB70AEE5523A03FD9
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....h.y.........." .........................................................@............`A........................................P...4............0...................!..............p............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-stdio-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):17872
                                                                                                                                                                                                                            Entropy (8bit):6.3934828478655685
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO
                                                                                                                                                                                                                            MD5:55B2EB7F17F82B2096E94BCA9D2DB901
                                                                                                                                                                                                                            SHA1:44D85F1B1134EE7A609165E9C142188C0F0B17E0
                                                                                                                                                                                                                            SHA-256:F9D3F380023A4C45E74170FE69B32BCA506EE1E1FBE670D965D5B50C616DA0CB
                                                                                                                                                                                                                            SHA-512:0CF0770F5965A83F546253DECFA967D8F85C340B5F6EA220D3CAA14245F3CDB37C53BF8D3DA6C35297B22A3FA88E7621202634F6B3649D7D9C166A221D3456A5
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......w.........." ......... ...............................................@......>>....`A........................................P...a............0...............$...!..............p............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-string-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):18384
                                                                                                                                                                                                                            Entropy (8bit):6.279474608881223
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft
                                                                                                                                                                                                                            MD5:9B79965F06FD756A5EFDE11E8D373108
                                                                                                                                                                                                                            SHA1:3B9DE8BF6B912F19F7742AD34A875CBE2B5FFA50
                                                                                                                                                                                                                            SHA-256:1A916C0DB285DEB02C0B9DF4D08DAD5EA95700A6A812EA067BD637A91101A9F6
                                                                                                                                                                                                                            SHA-512:7D4155C00D65C3554E90575178A80D20DC7C80D543C4B5C4C3F508F0811482515638FE513E291B82F958B4D7A63C9876BE4E368557B07FF062961197ED4286FB
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...$............" ........."...............................................@............`A........................................P................0...............&...!..............p............................................................................rdata../...........................@..@.rsrc........0......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-time-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14288
                                                                                                                                                                                                                            Entropy (8bit):6.547753630184197
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
                                                                                                                                                                                                                            MD5:1D48A3189A55B632798F0E859628B0FB
                                                                                                                                                                                                                            SHA1:61569A8E4F37ADC353986D83EFC90DC043CDC673
                                                                                                                                                                                                                            SHA-256:B56BC94E8539603DD2F0FEA2F25EFD17966315067442507DB4BFFAFCBC2955B0
                                                                                                                                                                                                                            SHA-512:47F329102B703BFBB1EBAEB5203D1C8404A0C912019193C93D150A95BB0C5BA8DC101AC56D3283285F9F91239FC64A66A5357AFE428A919B0BE7194BADA1F64F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...E............" .........................................................0......f.....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\api-ms-win-crt-utility-l1-1-0.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):12240
                                                                                                                                                                                                                            Entropy (8bit):6.686357863452704
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c
                                                                                                                                                                                                                            MD5:DBC27D384679916BA76316FB5E972EA6
                                                                                                                                                                                                                            SHA1:FB9F021F2220C852F6FF4EA94E8577368F0616A4
                                                                                                                                                                                                                            SHA-256:DD14133ADF5C534539298422F6C4B52739F80ACA8C5A85CA8C966DEA9964CEB1
                                                                                                                                                                                                                            SHA-512:CC0D8C56749CCB9D007B6D3F5C4A8F1D4E368BB81446EBCD7CC7B40399BBD56D0ACABA588CA172ECB7472A8CBDDBD4C366FFA38094A832F6D7E343B813BA565E
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....@n#.........." .........................................................0............`A........................................P...^............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\base_library.zip

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1440734
                                                                                                                                                                                                                            Entropy (8bit):5.590383253842785
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24576:mQR5pATG8/R5lUKdcubgAnyfb8h30iwhBdYf9PfeYHHc:mQR5pE/RbPu
                                                                                                                                                                                                                            MD5:D220B7E359810266FE6885A169448FA0
                                                                                                                                                                                                                            SHA1:556728B326318B992B0DEF059ECA239EB14BA198
                                                                                                                                                                                                                            SHA-256:CA40732F885379489D75A2DEC8EB68A7CCE024F7302DD86D63F075E2745A1E7D
                                                                                                                                                                                                                            SHA-512:8F802C2E717B0CB47C3EEEA990FFA0214F17D00C79CE65A0C0824A4F095BDE9A3D9D85EFB38F8F2535E703476CB6F379195565761A0B1D738D045D7BB2C0B542
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\certifi\cacert.pem

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):291528
                                                                                                                                                                                                                            Entropy (8bit):6.047650375646611
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5NP:QWb/TRJLWURrI5RWavdF0J
                                                                                                                                                                                                                            MD5:181AC9A809B1A8F1BC39C1C5C777CF2A
                                                                                                                                                                                                                            SHA1:9341E715CEA2E6207329E7034365749FCA1F37DC
                                                                                                                                                                                                                            SHA-256:488BA960602BF07CC63F4EF7AEC108692FEC41820FC3328A8E3F3DE038149AEE
                                                                                                                                                                                                                            SHA-512:E19A92B94AEDCF1282B3EF561BD471EA19ED361334092C55D72425F9183EBD1D30A619E493841B6F75C629F26F28DC682960977941B486C59475F21CF86FFF85
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\charset_normalizer\md.cp311-win_amd64.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                            Entropy (8bit):4.673454313041419
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:KG+p72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFliHUWQcX6g8cim1qeSju1:A2HzzU2bRYoeLHkcqgvimoe
                                                                                                                                                                                                                            MD5:723EC2E1404AE1047C3EF860B9840C29
                                                                                                                                                                                                                            SHA1:8FC869B92863FB6D2758019DD01EDBEF2A9A100A
                                                                                                                                                                                                                            SHA-256:790A11AA270523C2EFA6021CE4F994C3C5A67E8EAAAF02074D5308420B68BD94
                                                                                                                                                                                                                            SHA-512:2E323AE5B816ADDE7AAA14398F1FDB3EFE15A19DF3735A604A7DB6CADC22B753046EAB242E0F1FBCD3310A8FBB59FF49865827D242BAF21F44FD994C3AC9A878
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d...siAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):119296
                                                                                                                                                                                                                            Entropy (8bit):5.872097486056729
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:OzgMw0g+m/+rxC9Jtd960WsCyqPD1/bZMlDML48Be9zGTVmZRJIRbvB:OsTH+VC9Jtd9VdCr7fMp/8yGTVmzmZ
                                                                                                                                                                                                                            MD5:9EA8098D31ADB0F9D928759BDCA39819
                                                                                                                                                                                                                            SHA1:E309C85C1C8E6CE049EEA1F39BEE654B9F98D7C5
                                                                                                                                                                                                                            SHA-256:3D9893AA79EFD13D81FCD614E9EF5FB6AAD90569BEEDED5112DE5ED5AC3CF753
                                                                                                                                                                                                                            SHA-512:86AF770F61C94DFBF074BCC4B11932BBA2511CAA83C223780112BDA4FFB7986270DC2649D4D3EA78614DBCE6F7468C8983A34966FC3F2DE53055AC6B5059A707
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d...siAe.........." ...%.*..........0........................................ ............`.........................................p...d..........................................Px...............................w..@............@...............................text...X).......*.................. ..`.rdata...X...@...Z..................@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info\INSTALLER

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info\METADATA

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):5440
                                                                                                                                                                                                                            Entropy (8bit):5.074743714114344
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:DlPQIUQIhQIKQILbQIRIaMPktjaVxsxA2TaLDmplH7dwnqTIvrUmA0JQTQCQx5KN:ecPuP1srTaLDmplH7JTIvYX0JQTQ9x54
                                                                                                                                                                                                                            MD5:1682E8458A9F3565FD0941626CBE4302
                                                                                                                                                                                                                            SHA1:E5937D80B6BA976905491C9DBD8E16D0226795B5
                                                                                                                                                                                                                            SHA-256:24F9838874233DE69F9DE9AEBD95359E499498508D962B605D90186288D7D8C0
                                                                                                                                                                                                                            SHA-512:2DC669A07DD263C967D637AC2E76ED3788830D96B91E256E16125997C4E3A68D268DC220C056BBFBC3B5E7DEF7D063B776D9D1DA303A840FF203DAE668D7A366
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:Metadata-Version: 2.3.Name: cryptography.Version: 43.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info\RECORD

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):15485
                                                                                                                                                                                                                            Entropy (8bit):5.564090812037898
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:aXMKlej5z5jF4ELZVhXau4WPE6FGotqw++NX6in55qw/n+B:aXMZj5hCEJaiPE6FGotqw++96in5+B
                                                                                                                                                                                                                            MD5:5AD5EA98ABF6A64D03C4DD29DB5B14EB
                                                                                                                                                                                                                            SHA1:1ED79F451F6EDC77DBC25543F38F2AB479367C8D
                                                                                                                                                                                                                            SHA-256:4510A5800D33CC9C9AA0F240FE5CD95962A916A55D8B608634AE4ABB2D8DDB7C
                                                                                                                                                                                                                            SHA-512:F26F9161E8935D162CB487A56A69509721CDE9EA66906086E7A0EB6CA37A48B382CE6E6D457784A9EB1A7BDA5614D8C9D0169CBA9E940D8F4194A1EF1175391D
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:cryptography-43.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.0.dist-info/METADATA,sha256=JPmDiHQjPeafnemuvZU1nkmUmFCNlitgXZAYYojX2MA,5440..cryptography-43.0.0.dist-info/RECORD,,..cryptography-43.0.0.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.0.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.0.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.0.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=AuJuBuUXFu8XM-ndNcp4DzJNCld3qQyfRJFH_AgNI-0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-311.pyc,,..cryptography/__pycache__/__init__.cpython-311.pyc,,..cryptography/__pycache__/exceptions.cpython-311.pyc,,..cryptography/__p

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info\WHEEL

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):94
                                                                                                                                                                                                                            Entropy (8bit):5.016084900984752
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
                                                                                                                                                                                                                            MD5:C869D30012A100ADEB75860F3810C8C9
                                                                                                                                                                                                                            SHA1:42FD5CFA75566E8A9525E087A2018E8666ED22CB
                                                                                                                                                                                                                            SHA-256:F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
                                                                                                                                                                                                                            SHA-512:B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info\license_files\LICENSE

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):197
                                                                                                                                                                                                                            Entropy (8bit):4.61968998873571
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                                            MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                                            SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                                            SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                                            SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info\license_files\LICENSE.APACHE

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):11360
                                                                                                                                                                                                                            Entropy (8bit):4.426756947907149
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                                            MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                                            SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                                            SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                                            SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography-43.0.0.dist-info\license_files\LICENSE.BSD

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1532
                                                                                                                                                                                                                            Entropy (8bit):5.058591167088024
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                                            MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                                            SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                                            SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                                            SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):7926272
                                                                                                                                                                                                                            Entropy (8bit):6.5147148491950295
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:98304:YWAalLQ17mZ4P3+A2AzbF5pXDog7d81ERQK:UJbF5lDog7d4xK
                                                                                                                                                                                                                            MD5:B98D491EAD30F30E61BC3E865AB72F18
                                                                                                                                                                                                                            SHA1:DB165369B7F2AE513B51C4F3DEF9EA2668268221
                                                                                                                                                                                                                            SHA-256:35D5AEB890B99E6BAE3E6B863313FBC8A1A554ACBCD416FE901B1E1AE2993C98
                                                                                                                                                                                                                            SHA-512:044C9C39BDDB13020ED865D3AA30926460AE6DED5FDEA59ECA2B1CF6A4DED55728D883F19EE0749F95A4D93F66E04FCC62BC3BE67119C4CCABD17B003CF5F3C4
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C_M..>#..>#..>#..F...>#.."..>#.. ..>#..'..>#..&..>#.LF"..>#.h."..>#..>"..<#...'.y=#..>#.>#...#..>#...!..>#.Rich.>#.........PE..d...-.f.........." ...(..Z..|........X......................................Py...........`.........................................0.r.......r..............`t..............`x.0.....j.T.....................j.(...`.j.@.............Z..............................text...;.Z.......Z................. ..`.rdata...p....Z..r....Z.............@..@.data....+...0s.......s.............@....pdata.......`t.......t.............@..@.reloc..0....`x.......x.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\libcrypto-3.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):5162776
                                                                                                                                                                                                                            Entropy (8bit):5.958207976652471
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
                                                                                                                                                                                                                            MD5:51E8A5281C2092E45D8C97FBDBF39560
                                                                                                                                                                                                                            SHA1:C499C810ED83AAADCE3B267807E593EC6B121211
                                                                                                                                                                                                                            SHA-256:2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
                                                                                                                                                                                                                            SHA-512:98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\libffi-8.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):39696
                                                                                                                                                                                                                            Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                            MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                            SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                            SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                            SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\libssl-3.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):790296
                                                                                                                                                                                                                            Entropy (8bit):5.607732992846443
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
                                                                                                                                                                                                                            MD5:BFC834BB2310DDF01BE9AD9CFF7C2A41
                                                                                                                                                                                                                            SHA1:FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
                                                                                                                                                                                                                            SHA-256:41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
                                                                                                                                                                                                                            SHA-512:6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):67072
                                                                                                                                                                                                                            Entropy (8bit):5.909510426434191
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:aJsHmR02IvVxv7WCyKm7c5Th4MBHTOvyyaZE:apIvryCyKx5Th4M5OvyyO
                                                                                                                                                                                                                            MD5:3E579844160DE8322D574501A0F91516
                                                                                                                                                                                                                            SHA1:C8DE193854F7FC94F103BD4AC726246981264508
                                                                                                                                                                                                                            SHA-256:95F01CE7E37F6B4B281DBC76E9B88F28A03CB02D41383CC986803275A1CD6333
                                                                                                                                                                                                                            SHA-512:EE2A026E8E70351D395329C78A07ACB1B9440261D2557F639E817A8149BA625173EF196AED3D1C986577D78DC1A7EC9FED759C19346C51511474FE6D235B1817
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d.....qf.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\pyexpat.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):199448
                                                                                                                                                                                                                            Entropy (8bit):6.37860626187966
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:JmRBHO1UpyGKEjQxmMLIQjmuMgk6k6k6k6k6k6jHlDX:JmRBHJS7Mgk6k6k6k6k6k6jFDX
                                                                                                                                                                                                                            MD5:6527063F18E8D49D04E2CC216C2F0B27
                                                                                                                                                                                                                            SHA1:917C349C62689F9B782A314CE4B2311B6B826606
                                                                                                                                                                                                                            SHA-256:5604F629523125904909547A97F3CDB5DBFE33B39878BAD77534DE0C3C034387
                                                                                                                                                                                                                            SHA-512:67C87D11683A0F4E1BC4083FF05EDEE423155F829051C3FA66CC4F2CFB98CF7374B3A06EB37095E19F5F2A6C8DA83F0C0E3F7EB964694992B525F81B1B00F423
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................g.................................h.......................h.......h.......h.......h.......Rich....................PE..d......e.........." ...#..................................................... ......X.....`.............................................P................................/..........`3..T........................... 2..@............ ...............................text...3........................... ..`.rdata....... ......................@..@.data...@!..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\python3.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):67352
                                                                                                                                                                                                                            Entropy (8bit):6.1462717896521335
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:lGw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJa:r/5k8cnzeJd9IVL0v7SyJwx/
                                                                                                                                                                                                                            MD5:D8BA00C1D9FCC7C0ABBFFB5C214DA647
                                                                                                                                                                                                                            SHA1:5FA9D5700B42A83BFCC125D1C45E0111B9D62035
                                                                                                                                                                                                                            SHA-256:E45452EFA356DB874F2E5FF08C9CC0FE22528609E5D341F8FB67BA48885AB77D
                                                                                                                                                                                                                            SHA-512:DF1B714494856F618A742791EEFBF470B2EEE07B51D983256E4386EA7D48DA5C7B1E896F222EA55A748C9413203886CDE3A65EF9E7EA069014FA626F81D79CD3
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."e.."e.."e.0_m.."e.0_e.."e.0_..."e.0_g.."e.Rich."e.................PE..d......e.........." ...#.................................................................`.........................................`...P................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\python311.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):5763864
                                                                                                                                                                                                                            Entropy (8bit):6.089317968812699
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:98304:CdT9zf0+IXY3qd4biqm46oWHrMGYPtA81:CdT9zflIXgq/epGWAs
                                                                                                                                                                                                                            MD5:65E381A0B1BC05F71C139B0C7A5B8EB2
                                                                                                                                                                                                                            SHA1:7C4A3ADF21EBCEE5405288FC81FC4BE75019D472
                                                                                                                                                                                                                            SHA-256:53A969094231B9032ABE4148939CE08A3A4E4B30B0459FC7D90C89F65E8DCD4A
                                                                                                                                                                                                                            SHA-512:4DB465EF927DFB019AB6FAEC3A3538B0C3A8693EA3C2148FD16163BF31C03C899DFDF350C31457EDF64E671E3CC3E46851F32F0F84B267535BEBC4768EF53D39
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ..qN.qN.qN.$.O.qN.$...qN.$.K.qN.$.J.qN.$.M.qN....qN...O.qN.qO..pN.B.C.]qN.B.N.qN.B...qN.B.L.qN.Rich.qN.........PE..d......e.........." ...#.R%..>7......=........................................\.....T.X...`...........................................@......[A......p[.......V../....W../....[.lC....).T...........................p.).@............p%..............................text...ZQ%......R%................. ..`.rdata.......p%......V%.............@..@.data....#....A..T...fA.............@....pdata.../....V..0....Q.............@..@PyRuntim......X.......S.............@....rsrc........p[......vV.............@..@.reloc..lC....[..D....V.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32\pythoncom311.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):669696
                                                                                                                                                                                                                            Entropy (8bit):6.035392172368621
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:mjN+cC8C0nALOrc5qcse64RV7n04pd+1xeo:AN+cnCqrcEbefFno
                                                                                                                                                                                                                            MD5:F98264F2DACFC8E299391ED1180AB493
                                                                                                                                                                                                                            SHA1:849551B6D9142BF983E816FEF4C05E639D2C1018
                                                                                                                                                                                                                            SHA-256:0FE49EC1143A0EFE168809C9D48FE3E857E2AC39B19DB3FD8718C56A4056696B
                                                                                                                                                                                                                            SHA-512:6BB3DBD9F4D3E6B7BD294F3CB8B2EF4C29B9EFF85C0CFD5E2D2465BE909014A7B2ECD3DC06265B1B58196892BB04D3E6B0AA4B2CCBF3A716E0FF950EB28DB11C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`...3...3...3..\3...3...2...3...2...3...2...3...2...3...2...3U..2...3...2...3...3..3U..2..3U..2...3U..2...3Rich...3................PE..d...f..d.........." ......................................................................`..........................................U...c..............l....@...z............... ......T...........................0...8............................................text............................... ..`.rdata...#.......$..................@..@.data....I..........................@....pdata...z...@...|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\pywin32_system32\pywintypes311.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):134656
                                                                                                                                                                                                                            Entropy (8bit):5.995319660651805
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:luJ2G0a2fYrFceQaVK756Y/r06trRjEKQze7KN9eJKVKG6j1J:luJ2faiYrFceQaVfY/rx1eze7KbewVrk
                                                                                                                                                                                                                            MD5:90B786DC6795D8AD0870E290349B5B52
                                                                                                                                                                                                                            SHA1:592C54E67CF5D2D884339E7A8D7A21E003E6482F
                                                                                                                                                                                                                            SHA-256:89F2A5C6BE1E70B3D895318FDD618506B8C0E9A63B6A1A4055DFF4ABDC89F18A
                                                                                                                                                                                                                            SHA-512:C6E1DBF25D260C723A26C88EC027D40D47F5E28FC9EB2DBC72A88813A1D05C7F75616B31836B68B87DF45C65EEF6F3EAED2A9F9767F9E2F12C45F672C2116E72
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.$g..wg..wg..wn.[wk..w5..vc..w..5wf..w5..vs..w5..vo..w5..vd..ws..vf..w...ve..ws..vl..wg..w...w...vj..w...vf..w...vf..wRichg..w........PE..d......d.........." ................L........................................P............`......................................... u..`B......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\select.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):30488
                                                                                                                                                                                                                            Entropy (8bit):6.582368880935187
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:neUeJhHq2GD9IVQGA5YiSyv3g+AMxkEdC:neUeJhK2GD9IVQGS7SyfgMxRC
                                                                                                                                                                                                                            MD5:8472D39B9EE6051C961021D664C7447E
                                                                                                                                                                                                                            SHA1:B284E3566889359576D43E2E0E99D4ACF068E4FB
                                                                                                                                                                                                                            SHA-256:8A9A103BC417DEDE9F6946D9033487C410937E1761D93C358C1600B82F0A711F
                                                                                                                                                                                                                            SHA-512:309F1EC491D9C39F4B319E7CE1ABDEDF11924301E4582D122E261E948705FB71A453FEC34F63DF9F9ABE7F8CC2063A56CD2C2935418AB54BE5596AADC2E90AD3
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q|'.q|'.q|'...'.q|'q.}&.q|'q.y&.q|'q.x&.q|'q..&.q|'..}&.q|'.q}'.q|'..}&.q|'..q&.q|'..|&.q|'...'.q|'..~&.q|'Rich.q|'........PE..d......e.........." ...#.....2......................................................;.....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info\INSTALLER

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                            Entropy (8bit):1.5
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:Mn:M
                                                                                                                                                                                                                            MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                            SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                            SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                            SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:pip.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info\LICENSE

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1050
                                                                                                                                                                                                                            Entropy (8bit):5.072538194763298
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24:1rmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:1aJ8YHvEH5QHOs5exm3oEFJ
                                                                                                                                                                                                                            MD5:7A7126E068206290F3FE9F8D6C713EA6
                                                                                                                                                                                                                            SHA1:8E6689D37F82D5617B7F7F7232C94024D41066D1
                                                                                                                                                                                                                            SHA-256:DB3F0246B1F9278F15845B99FEC478B8B506EB76487993722F8C6E254285FAF8
                                                                                                                                                                                                                            SHA-512:C9F0870BC5D5EFF8769D9919E6D8DDE1B773543634F7D03503A9E8F191BD4ACC00A97E0399E173785D1B65318BAC79F41D3974AE6855E5C432AC5DACF8D13E8A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:Copyright Jason R. Coombs..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTW

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info\METADATA

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):6301
                                                                                                                                                                                                                            Entropy (8bit):5.107162422517841
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:W4rkAIG0wRg8wbNDdq6T9927uoU/GBpHFwTZ:Sq0wRg8wbNDdBh927uoU/GBRFi
                                                                                                                                                                                                                            MD5:9E59BD13BB75B38EB7962BF64AC30D6F
                                                                                                                                                                                                                            SHA1:70F6A68B42695D1BFA55ACB63D8D3351352B2AAC
                                                                                                                                                                                                                            SHA-256:80C7A3B78EA0DFF1F57855EE795E7D33842A0827AA1EF4EE17EC97172A80C892
                                                                                                                                                                                                                            SHA-512:67AC61739692ECC249EBDC8F5E1089F68874DCD65365DB1C389FDD0CECE381591A30B99A2774B8CAAA00E104F3E35FF3745AFF6F5F0781289368398008537AE7
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:Metadata-Version: 2.1.Name: setuptools.Version: 65.5.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.Project-URL: Documentation, https://setuptools.pypa.io/.Project-URL: Changelog, https://setuptools.pypa.io/en/stable/history.html.Keywords: CPAN PyPI distutils eggs package management.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: Topic :: System :: Systems Administration.Classifier: Topic :: Utilities.Requires-Python: >=3.7.License-File: LICENSE.Provides-Extra: certs.Provides-Extra: docs.Requi

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info\RECORD

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:CSV text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):37694
                                                                                                                                                                                                                            Entropy (8bit):5.555787611309118
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:vSzcBlShgRUhbul9nXJkpIVh498WjXYH0+5+E/8mrnaDoaQP7IOQRJqxBPgof2yd:vc853yQXYAY8AKCT9r2/GsIVxE9Im
                                                                                                                                                                                                                            MD5:087F72A04BB085627494651E36C4C513
                                                                                                                                                                                                                            SHA1:1E39070E246F91D8926268A033C6F584E629E2DE
                                                                                                                                                                                                                            SHA-256:BFB77A968E06417BD37023BF1A2D7F1AAE9D8E74231665D6699D5BB82BDBD7B0
                                                                                                                                                                                                                            SHA-512:39CE042A20324C6B63A192D70E56B36318C45D04B810A6BD333D1D40B6DAAD947AFB9156C003BC86C700A59F0F25753416D754DA06C808814920F92582CB6058
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:_distutils_hack/__init__.py,sha256=TSekhUW1fdE3rjU3b88ybSBkJxCEpIeWBob4cEuU3ko,6128.._distutils_hack/__pycache__/__init__.cpython-311.pyc,,.._distutils_hack/__pycache__/override.cpython-311.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=JjjOniUA5XKl4N5_rtZmHrVp0baW_LoHsN0iPaX10iQ,151..pkg_resources/__init__.py,sha256=fT5Y3P1tcSX8sJomClUU10WHeFmvqyNZM4UZHzdpAvg,108568..pkg_resources/__pycache__/__init__.cpython-311.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-311.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-311.pyc,,..pkg_resources/_vendor/__pycache__/zipp.cpython-311.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/importlib_resources/__init__.py,sha256=evPm12kLgYqTm-pbzm60bOuumumT8IpBNWFp0uMyrzE,506..pkg_resources/_vendor/importli

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info\WHEEL

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):92
                                                                                                                                                                                                                            Entropy (8bit):4.820827594031884
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:RtEeX7MWcSlViZHKRRP+tPCCfA5S:RtBMwlViojWBBf
                                                                                                                                                                                                                            MD5:4D57030133E279CEB6A8236264823DFD
                                                                                                                                                                                                                            SHA1:0FDC3988857C560E55D6C36DCC56EE21A51C196D
                                                                                                                                                                                                                            SHA-256:1B5E87E00DC87A84269CEAD8578B9E6462928E18A95F1F3373C9EEF451A5BCC0
                                                                                                                                                                                                                            SHA-512:CD98F2A416AC1B13BA82AF073D0819C0EA7C095079143CAB83037D48E9A5450D410DC5CF6B6CFF3F719544EDF1C5F0C7E32E87B746F1C04FE56FAFD614B39826
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.37.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info\entry_points.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):2740
                                                                                                                                                                                                                            Entropy (8bit):4.540737240939103
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:48:lELcZDy3g6ySDsm90rZh2Phv4hhpTqTog:yLAP8arZoP94hTTqcg
                                                                                                                                                                                                                            MD5:D3262B65DB35BFFAAC248075345A266C
                                                                                                                                                                                                                            SHA1:93AD6FE5A696252B9DEF334D182432CDA2237D1D
                                                                                                                                                                                                                            SHA-256:DEC880BB89189B5C9B1491C9EE8A2AA57E53016EF41A2B69F5D71D1C2FBB0453
                                                                                                                                                                                                                            SHA-512:1726750B22A645F5537C20ADDF23E3D3BAD851CD4BDBA0F9666F9F6B0DC848F9919D7AF8AD8847BD4F18D0F8585DDE51AFBAE6A4CAD75008C3210D17241E0291
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.build = setuptools.command.build:build.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.editable_wheel = setuptools.command.editable_wheel:editable_wheel.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveopts = setuptools.command.saveopts:saveopts.sdist = setuptools.command.sdist:sdist.seto

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\setuptools-65.5.0.dist-info\top_level.txt

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                            Entropy (8bit):3.9115956018096876
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:3Wd+Nt8AfQYv:3Wd+Nttv
                                                                                                                                                                                                                            MD5:789A691C859DEA4BB010D18728BAD148
                                                                                                                                                                                                                            SHA1:AEF2CBCCC6A9A8F43E4E150E7FCF1D7B03F0E249
                                                                                                                                                                                                                            SHA-256:77DC8BDFDBFF5BBAA62830D21FAB13E1B1348FF2ECD4CDCFD7AD4E1A076C9B88
                                                                                                                                                                                                                            SHA-512:BC2F7CAAD486EB056CB9F68E6C040D448788C3210FF028397CD9AF1277D0051746CAE58EB172F9E73EA731A65B2076C6091C10BCB54D911A7B09767AA6279EF6
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:_distutils_hack.pkg_resources.setuptools.

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\sqlite3.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1504024
                                                                                                                                                                                                                            Entropy (8bit):6.578984314535122
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24576:M5WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lYfore60b:Mb0yVKMyjWR6nofQm7U59HWKYYD
                                                                                                                                                                                                                            MD5:256224CC25D085663D4954BE6CC8C5B5
                                                                                                                                                                                                                            SHA1:9931CC156642E2259DFABF0154FDDF50D86E9334
                                                                                                                                                                                                                            SHA-256:5AC6EE18CDCA84C078B66055F5E9FFC6F8502E22EAF0FA54AEEC92B75A3C463E
                                                                                                                                                                                                                            SHA-512:A28ABF03199F0CE9F044329F7EBA2F1D8ECBC43674337AAFBF173F567158BA9046036DA91DC3E12C2BB1D7842953526EDBA14BC03F81ECE63DCEDCC9413213A7
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..W..W..^.P.[....U....Z...._.....S.....T..W........V.....V....<.V......V..RichW..........................PE..d......e.........." ...#..................................................................`.........................................Px...".............................../...........*..T............................(..@...............8............................text............................... ..`.rdata..............................@..@.data...PG.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\ucrtbase.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1035728
                                                                                                                                                                                                                            Entropy (8bit):6.630126944065657
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
                                                                                                                                                                                                                            MD5:849959A003FA63C5A42AE87929FCD18B
                                                                                                                                                                                                                            SHA1:D1B80B3265E31A2B5D8D7DA6183146BBD5FB791B
                                                                                                                                                                                                                            SHA-256:6238CBFE9F57C142B75E153C399C478D492252FDA8CB40EE539C2DCB0F2EB232
                                                                                                                                                                                                                            SHA-512:64958DABDB94D21B59254C2F074DB5D51E914DDBC8437452115DFF369B0C134E50462C3FDBBC14B6FA809A6EE19AB2FB83D654061601CC175CDDCB7D74778E09
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d.....$%.........." .....:..........0Z..............................................7^....`A................................................................. ...........!.............p........................... f..............................................text...09.......:.................. ..`.rdata..^....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\unicodedata.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1141016
                                                                                                                                                                                                                            Entropy (8bit):5.435201566416684
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:C3kYbfjwR6nbVonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1Ji:CUYbM40IDJcjEwPgPOG6Xyd461Ji
                                                                                                                                                                                                                            MD5:57F8F40CF955561A5044DDFFA4F2E144
                                                                                                                                                                                                                            SHA1:19218025BCAE076529E49DDE8C74F12E1B779279
                                                                                                                                                                                                                            SHA-256:1A965C1904DA88989468852FDC749B520CCE46617B9190163C8DF19345B59560
                                                                                                                                                                                                                            SHA-512:DB2A7A32E0B5BF0684A8C4D57A1D7DF411D8EB1BC3828F44C95235DD3AF40E50A198427350161DFF2E79C07A82EF98E1536E0E013030A15BDF1116154F1D8338
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4m..4m..4m..=...2m......6m......9m......<m......7m......7m......6m..4m..em......5m......5m....j.5m......5m..Rich4m..................PE..d......e.........." ...#.@..........P*...............................................~....`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\win32\_win32sysloader.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                            Entropy (8bit):5.115373165177945
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:yuCm72PEO1jIUs0YqEcPbF55UgCWV4rofnbPutEvbqDLWn7ycLmrN/:LardA0Bzx14r6nbF0W+/
                                                                                                                                                                                                                            MD5:6B3D025362F13D2E112D7FEC4B58BF0C
                                                                                                                                                                                                                            SHA1:4A26921FCD1E9EE19C2D8BF67FB8ACF9C48AE359
                                                                                                                                                                                                                            SHA-256:48D2D1F61383DCAF65F5F4F08CAE96F4A915EB89C3EA23D0EF9AE7B0A8173399
                                                                                                                                                                                                                            SHA-512:3023901EDFF779DBD1FF37BA9FB950ECD6D9AC8117EA7A0585A004DA453B98AE5EAB8C2B15C85DCD6E0E9C24EF6734D4AE322B9E5C5E6C9553148B01A14BE808
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.f. ... ... ...).."...r..."...4..."...r...+...r...(...r...#.......#... ...........!.......!.......!...Rich ...........PE..d......d.........." ......................................................................`..........................................;..`...`;..d....p..t....`..................@...|2..T............................2..8............0..p............................text............................... ..`.rdata..$....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\win32\win32api.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):133632
                                                                                                                                                                                                                            Entropy (8bit):5.851354810898845
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:HPwB2zC1vwC3XetCf5RlRVFhLaNKPAyymhNYm9b9e:HIB2zkvwGXetCfDlRVlPAyLYm9
                                                                                                                                                                                                                            MD5:1D6762B494DC9E60CA95F7238AE1FB14
                                                                                                                                                                                                                            SHA1:AA0397D96A0ED41B2F03352049DAFE040D59AD5D
                                                                                                                                                                                                                            SHA-256:FAE5323E2119A8F678055F4244177B5806C7B6B171B1945168F685631B913664
                                                                                                                                                                                                                            SHA-512:0B561F651161A34C37FF8D115F154C52202F573D049681F8CDD7BBA2E966BB8203780C19BA824B4A693EF12EF1EEEF6AEEEF96EB369E4B6129F1DEB6B26AAA00
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I^.f'..f'..f'......f'...&..f'...#..f'...$..f'.o.&..f'..."..f'...&..f'..f&..g'.o....f'.o.'..f'.o.%..f'.Rich.f'.................PE..d......d.........." .........................................................P............`..........................................................0..\....................@..$....v..T............................<..8............0..........@....................text...$........................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..$....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\win32\win32crypt.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):123904
                                                                                                                                                                                                                            Entropy (8bit):5.966536263597539
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:qcoj2WDPYNSPEkIrFCkAShRD/bv0SShzljLraBqf9308qxJ83zEBoPTEdLQEF8/d:q7jbPA0SD9S3vrCqf93xM4TEdLZn1xa
                                                                                                                                                                                                                            MD5:5390ADE0ED5428024F3D854B5B9BFE9F
                                                                                                                                                                                                                            SHA1:DADA7B44887DCB7B77DCADB9690BAECF3EE2B937
                                                                                                                                                                                                                            SHA-256:9771F09BE29BD7A69ABE774E28472A392382883C18A3CC524F8141E84B1BE22C
                                                                                                                                                                                                                            SHA-512:92E82EFF79F45D4DE1CF27946A357F122C5337A85315D7C139458A1A6A51DFFBF3CBFCF832851FBDCD0EC1BD0F82E7089125FFBBE3275675433089BDDBFF865B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.v.S.......Q.......E.......].......V.....Q...A...R...U........\.....T.....T...RichU...........PE..d......d.........." ................(........................................ ............`..........................................o..................d.......................H....G..T............................H..8............................................text...~........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...d...........................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\win32\win32trace.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):23552
                                                                                                                                                                                                                            Entropy (8bit):5.2797447560366155
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:JPeeH8ZmV+zknwMsADuVLw0T8DmDRl2jYI7AHCQnpC9QJX1B5:JL+zi/uVbSYI4d6CB
                                                                                                                                                                                                                            MD5:2705D0AC399B949261F4D9AF473DBA7C
                                                                                                                                                                                                                            SHA1:2B84CEDFCB90F8278E698AC2319C860F373060F2
                                                                                                                                                                                                                            SHA-256:961D93DBD18F33685C5384F4346D8AF2A452E51F7171E6CB053B9BB260EDA5A3
                                                                                                                                                                                                                            SHA-512:F546670352D5934F11EFBE53AE382EE96E9D88DB7A8709EE1CEC36474E61E3C3DD9EDC01A8557152A0F3F0CF808410E31AE37F178BB2F34EC00156808103C72D
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>].OP..OP..OP..7...OP..:Q..OP..:U..OP..:T..OP..:S..OP..:Q..OP..$Q..OP..OQ..OP..:Y..OP..:P..OP..:R..OP.Rich.OP.................PE..d......d.........." .....,...,.......(....................................................`..........................................Q..T...dQ..........d....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI63922\win32com\shell\shell.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):528384
                                                                                                                                                                                                                            Entropy (8bit):6.160492941773028
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:x1uoSNIiaRGfvtQqmJeRAsgUW9yKj6pWa1P5ziI7RRWf:x1uoSNIH8HtQbems66pWab37R4f
                                                                                                                                                                                                                            MD5:8A0C2F96414475498D6E9BADA00DE986
                                                                                                                                                                                                                            SHA1:BB8E66F3DF9F25B12777E3F48BA7069940F0C920
                                                                                                                                                                                                                            SHA-256:3F45C59F75E61FA93B5C2B1F65995B621C3FD301FB500A17599BEFA54538D1D0
                                                                                                                                                                                                                            SHA-512:75D718F30209D81819CEA7B148D3A8DD7FCB9FC94E87A8DD5D7C795B334DEACD6A598F583475B7005D0E81929C9E70F19BABFE92BE1E1E39F62296078FDEEAEA
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.C.............bh.....Wo......Wo......Wo......Wo.......q.......o.......q.......q...............o..C....o.......o......Rich....................PE..d...#..d.........." .....$................................................................`.............................................L...............L.......xx...............!......T..............................8............@...............................text...n#.......$.................. ..`.rdata.......@.......(..............@..@.data...@....0...^..................@....pdata..xx.......z...p..............@..@.rsrc...L...........................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ndhlks3.v4u.ps1

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):60
                                                                                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bu4qqljf.pko.ps1

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):60
                                                                                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nkb0c5ok.5y2.ps1

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):60
                                                                                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pkbb4n5b.brd.psm1

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):60
                                                                                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_smveq3vu.2ub.psm1

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):60
                                                                                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vmorpygu.mqf.psm1

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):60
                                                                                                                                                                                                                            Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\autofill_db

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):196608
                                                                                                                                                                                                                            Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                            MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                            SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                            SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                            SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\cards_db

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):196608
                                                                                                                                                                                                                            Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                            MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                            SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                            SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                            SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\cookie_db

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                            Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                            MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                            SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                            SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                            SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\downloads_db

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):155648
                                                                                                                                                                                                                            Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                            MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                            SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                            SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                            SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\login_db

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):51200
                                                                                                                                                                                                                            Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                            MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                            SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                            SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                            SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\web_history_db

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):155648
                                                                                                                                                                                                                            Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                            MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                            SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                            SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                            SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            \Device\Null

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):44
                                                                                                                                                                                                                            Entropy (8bit):4.261043983337285
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:RLg9duHAFmLKUe9y:RLg9dugMe9y
                                                                                                                                                                                                                            MD5:AD2E5CC5CADCC56B8446CE435BD42CE4
                                                                                                                                                                                                                            SHA1:263793D122F1837B8916BF8623FE5AB4202E1131
                                                                                                                                                                                                                            SHA-256:78609DB3A08FA8D24F189A78895E9E5D49580969F42692E466652EF04EB254B2
                                                                                                                                                                                                                            SHA-512:A66C94FF4709245AD3F37DE98C9418D4AA1AEBE8EC234984E2BD6D80D6E76F7ABD70C0D357722714BB0C355716AFF3CB20970C01BE5FB4453AA3E5A523C9131E
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:ERROR: The process "exodus.exe" not found...

                                                                                                                                                                                                                            Static File Info

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Entropy (8bit):7.997371210548079
                                                                                                                                                                                                                            TrID:
                                                                                                                                                                                                                            • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                            • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                            • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                            File name:1.exe
                                                                                                                                                                                                                            File size:25'435'744 bytes
                                                                                                                                                                                                                            MD5:3689dace869abbbe4e87f57078f6bec9
                                                                                                                                                                                                                            SHA1:568f5a26f433d55c2628e3e3a5555a9046b19ee3
                                                                                                                                                                                                                            SHA256:610f9a21f99667ede85d082521e7b8150b158b80bc1d13c4498ac095b2316255
                                                                                                                                                                                                                            SHA512:07f18aaa4119df6a7711a8b21157e15473f2b2654fea6eb426857f745cc1b45eb22646c1f754f47cfd07b43b1840d3d31a9762f9354e9db10f06d82552034d2e
                                                                                                                                                                                                                            SSDEEP:393216:nEkQnvgKeQtss27CyDgPYVnNSMtW+eGQRJ93iObIhRS/DW3L8rpJ4s3E6spdp0w:nqjeQtspDgPQHW+e5RT9MhRD3Y9GQIZ
                                                                                                                                                                                                                            TLSH:3247331742624962F9A4013F5006C6245A31AC1177ACF2FA9FB5F8552BFFFAE8A31F44
                                                                                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc.....[hc...`.Qhc...g.Ihc...f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d..

                                                                                                                                                                                                                            File Icon

                                                                                                                                                                                                                            Icon Hash:44b27170b2706807

                                                                                                                                                                                                                            Static PE Info

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Entrypoint:0x14000c0d0
                                                                                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                                                                                            Digitally signed:false
                                                                                                                                                                                                                            Imagebase:0x140000000
                                                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                            Time Stamp:0x66B0ECA1 [Mon Aug 5 15:15:45 2024 UTC]
                                                                                                                                                                                                                            TLS Callbacks:
                                                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                                                            OS Version Major:6
                                                                                                                                                                                                                            OS Version Minor:0
                                                                                                                                                                                                                            File Version Major:6
                                                                                                                                                                                                                            File Version Minor:0
                                                                                                                                                                                                                            Subsystem Version Major:6
                                                                                                                                                                                                                            Subsystem Version Minor:0
                                                                                                                                                                                                                            Import Hash:456e8615ad4320c9f54e50319a19df9c

                                                                                                                                                                                                                            Entrypoint Preview

                                                                                                                                                                                                                            Instruction
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                                            call 00007F71E91D654Ch
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                                            jmp 00007F71E91D616Fh
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                                            call 00007F71E91D6918h
                                                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                                                            je 00007F71E91D6313h
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                            jmp 00007F71E91D62F7h
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            cmp ecx, eax
                                                                                                                                                                                                                            je 00007F71E91D6306h
                                                                                                                                                                                                                            xor eax, eax
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            cmpxchg dword ptr [0003843Ch], ecx
                                                                                                                                                                                                                            jne 00007F71E91D62E0h
                                                                                                                                                                                                                            xor al, al
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                                            ret
                                                                                                                                                                                                                            mov al, 01h
                                                                                                                                                                                                                            jmp 00007F71E91D62E9h
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                                            test ecx, ecx
                                                                                                                                                                                                                            jne 00007F71E91D62F9h
                                                                                                                                                                                                                            mov byte ptr [00038425h], 00000001h
                                                                                                                                                                                                                            call 00007F71E91D5A45h
                                                                                                                                                                                                                            call 00007F71E91D6D30h
                                                                                                                                                                                                                            test al, al
                                                                                                                                                                                                                            jne 00007F71E91D62F6h
                                                                                                                                                                                                                            xor al, al
                                                                                                                                                                                                                            jmp 00007F71E91D6306h
                                                                                                                                                                                                                            call 00007F71E91E383Fh
                                                                                                                                                                                                                            test al, al
                                                                                                                                                                                                                            jne 00007F71E91D62FBh
                                                                                                                                                                                                                            xor ecx, ecx
                                                                                                                                                                                                                            call 00007F71E91D6D40h
                                                                                                                                                                                                                            jmp 00007F71E91D62DCh
                                                                                                                                                                                                                            mov al, 01h
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                                            ret
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                            inc eax
                                                                                                                                                                                                                            push ebx
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            sub esp, 20h
                                                                                                                                                                                                                            cmp byte ptr [000383ECh], 00000000h
                                                                                                                                                                                                                            mov ebx, ecx
                                                                                                                                                                                                                            jne 00007F71E91D6359h
                                                                                                                                                                                                                            cmp ecx, 01h
                                                                                                                                                                                                                            jnbe 00007F71E91D635Ch
                                                                                                                                                                                                                            call 00007F71E91D688Eh
                                                                                                                                                                                                                            test eax, eax
                                                                                                                                                                                                                            je 00007F71E91D631Ah
                                                                                                                                                                                                                            test ebx, ebx
                                                                                                                                                                                                                            jne 00007F71E91D6316h
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            lea ecx, dword ptr [000383D6h]
                                                                                                                                                                                                                            call 00007F71E91E3632h

                                                                                                                                                                                                                            Data Directories

                                                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3c76c0x78.rdata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x490000xce34.rsrc
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x460000x2208.pdata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x560000x768.reloc
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x39dc00x1c.rdata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x39c800x140.rdata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x450.rdata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                            Sections

                                                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                            .text0x10000x292100x29400aca64598002ecff9eefbc96554edf015False0.5511067708333334data6.4784482217419175IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .rdata0x2b0000x126420x1280066146420f548cf2acca472542a84c0d8False0.5245460304054054data5.750861752432239IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .data0x3e0000x73d80xe00d0a288978c66419b180b35f625b6dce7False0.13532366071428573data1.8378139998458343IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .pdata0x460000x22080x240074cf3ea22e0a1756984435d6f80f7da5False0.4671223958333333data5.259201915045256IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .rsrc0x490000xce340xd000d717912eb54292316bc235b3159acb50False0.042367788461538464data3.816041843179243IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .reloc0x560000x7680x80071de9271648326ec88350e903470cf3eFalse0.5576171875data5.283119454571673IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                            Resources

                                                                                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                            RT_ICON0x490e80xc828Device independent bitmap graphic, 128 x 256 x 24, image size 512000.02777127244340359
                                                                                                                                                                                                                            RT_GROUP_ICON0x559100x14data1.15
                                                                                                                                                                                                                            RT_MANIFEST0x559240x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                            Imports

                                                                                                                                                                                                                            DLLImport
                                                                                                                                                                                                                            USER32.dllCreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                            COMCTL32.dll
                                                                                                                                                                                                                            KERNEL32.dllGetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, FormatMessageW, GetModuleFileNameW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, GetEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, WaitForSingleObject, Sleep, GetCurrentProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, IsProcessorFeaturePresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                                                                                                                                                                                                                            ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                            GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                            Network Behavior

                                                                                                                                                                                                                            Network Port Distribution

                                                                                                                                                                                                                            TCP Packets

                                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.112235069 CET49705443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.112281084 CET44349705151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.112354040 CET49705443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.113255024 CET49705443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.113269091 CET44349705151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.762650967 CET44349705151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.763458967 CET49705443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.763479948 CET44349705151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.764620066 CET44349705151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.764686108 CET49705443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.766285896 CET49705443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.766417027 CET44349705151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.766454935 CET49705443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:09.766477108 CET49705443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.566139936 CET49706443192.168.2.518.66.112.128
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.566175938 CET4434970618.66.112.128192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.566245079 CET49706443192.168.2.518.66.112.128
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.566546917 CET49706443192.168.2.518.66.112.128
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.566560984 CET4434970618.66.112.128192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.283132076 CET4434970618.66.112.128192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.283688068 CET49706443192.168.2.518.66.112.128
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.283706903 CET4434970618.66.112.128192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.284651041 CET4434970618.66.112.128192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.284725904 CET49706443192.168.2.518.66.112.128
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.286000013 CET49706443192.168.2.518.66.112.128
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.286058903 CET4434970618.66.112.128192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.286134958 CET49706443192.168.2.518.66.112.128
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.300324917 CET4970780192.168.2.5208.95.112.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.305087090 CET8049707208.95.112.1192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.305280924 CET4970780192.168.2.5208.95.112.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.305280924 CET4970780192.168.2.5208.95.112.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.310164928 CET8049707208.95.112.1192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.779674053 CET8049707208.95.112.1192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.780862093 CET4970780192.168.2.5208.95.112.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.785887957 CET8049707208.95.112.1192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.785948038 CET4970780192.168.2.5208.95.112.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.843286037 CET49708443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.843318939 CET44349708151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.843422890 CET49708443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.844085932 CET49708443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.844095945 CET44349708151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:13.488126993 CET44349708151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:13.493922949 CET49708443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:13.493937016 CET44349708151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:13.494997025 CET44349708151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:13.495058060 CET49708443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:13.513442039 CET49708443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:13.513572931 CET44349708151.80.152.246192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:13.513629913 CET49708443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:13.601749897 CET49708443192.168.2.5151.80.152.246
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.023834944 CET49899443192.168.2.534.117.59.81
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.023863077 CET4434989934.117.59.81192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.023972988 CET49899443192.168.2.534.117.59.81
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.024591923 CET49899443192.168.2.534.117.59.81
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.024605036 CET4434989934.117.59.81192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.494031906 CET4434989934.117.59.81192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.498528004 CET49899443192.168.2.534.117.59.81
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.498562098 CET4434989934.117.59.81192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.499913931 CET4434989934.117.59.81192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.499996901 CET49899443192.168.2.534.117.59.81
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.501247883 CET49899443192.168.2.534.117.59.81
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.501373053 CET4434989934.117.59.81192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.501424074 CET49899443192.168.2.534.117.59.81
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.501508951 CET49899443192.168.2.534.117.59.81
                                                                                                                                                                                                                            Jan 7, 2025 08:58:58.512028933 CET49947443192.168.2.545.112.123.126
                                                                                                                                                                                                                            Jan 7, 2025 08:58:58.512058020 CET4434994745.112.123.126192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:58.512243032 CET49947443192.168.2.545.112.123.126
                                                                                                                                                                                                                            Jan 7, 2025 08:58:58.512711048 CET49947443192.168.2.545.112.123.126
                                                                                                                                                                                                                            Jan 7, 2025 08:58:58.512721062 CET4434994745.112.123.126192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.164007902 CET4434994745.112.123.126192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.167896032 CET49947443192.168.2.545.112.123.126
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.167912960 CET4434994745.112.123.126192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.168792009 CET4434994745.112.123.126192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.168878078 CET49947443192.168.2.545.112.123.126
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.169861078 CET49947443192.168.2.545.112.123.126
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.169985056 CET4434994745.112.123.126192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.170010090 CET49947443192.168.2.545.112.123.126
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.170036077 CET49947443192.168.2.545.112.123.126
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.217757940 CET49952443192.168.2.5144.76.136.153
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.217843056 CET44349952144.76.136.153192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.217930079 CET49952443192.168.2.5144.76.136.153
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.218295097 CET49952443192.168.2.5144.76.136.153
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.218343019 CET44349952144.76.136.153192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:59:41.956304073 CET44349952144.76.136.153192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:59:41.956433058 CET49952443192.168.2.5144.76.136.153
                                                                                                                                                                                                                            Jan 7, 2025 08:59:41.956618071 CET49952443192.168.2.5144.76.136.153
                                                                                                                                                                                                                            Jan 7, 2025 08:59:41.956639051 CET44349952144.76.136.153192.168.2.5

                                                                                                                                                                                                                            UDP Packets

                                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                            Jan 7, 2025 08:58:08.649430037 CET5835953192.168.2.51.1.1.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:08.667754889 CET53583591.1.1.1192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.556544065 CET5713753192.168.2.51.1.1.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.564739943 CET53571371.1.1.1192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.292103052 CET5932853192.168.2.51.1.1.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.299335957 CET53593281.1.1.1192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.015739918 CET5442953192.168.2.51.1.1.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.023191929 CET53544291.1.1.1192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:58.502762079 CET6213553192.168.2.51.1.1.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:58.510498047 CET53621351.1.1.1192.168.2.5
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.173086882 CET5768053192.168.2.51.1.1.1
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.217051029 CET53576801.1.1.1192.168.2.5

                                                                                                                                                                                                                            DNS Queries

                                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                            Jan 7, 2025 08:58:08.649430037 CET192.168.2.51.1.1.10x17bStandard query (0)idefasoft.frA (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.556544065 CET192.168.2.51.1.1.10x3860Standard query (0)tiktok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.292103052 CET192.168.2.51.1.1.10xf873Standard query (0)ip-api.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.015739918 CET192.168.2.51.1.1.10x180aStandard query (0)ipinfo.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:58.502762079 CET192.168.2.51.1.1.10xbab9Standard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.173086882 CET192.168.2.51.1.1.10xfa8dStandard query (0)transfer.shA (IP address)IN (0x0001)false

                                                                                                                                                                                                                            DNS Answers

                                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                            Jan 7, 2025 08:58:08.667754889 CET1.1.1.1192.168.2.50x17bNo error (0)idefasoft.fr151.80.152.246A (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.564739943 CET1.1.1.1192.168.2.50x3860No error (0)tiktok.com18.66.112.128A (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.564739943 CET1.1.1.1192.168.2.50x3860No error (0)tiktok.com18.66.112.109A (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.564739943 CET1.1.1.1192.168.2.50x3860No error (0)tiktok.com18.66.112.57A (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:11.564739943 CET1.1.1.1192.168.2.50x3860No error (0)tiktok.com18.66.112.28A (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.299335957 CET1.1.1.1192.168.2.50xf873No error (0)ip-api.com208.95.112.1A (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:51.023191929 CET1.1.1.1192.168.2.50x180aNo error (0)ipinfo.io34.117.59.81A (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:58.510498047 CET1.1.1.1192.168.2.50xbab9No error (0)api.gofile.io45.112.123.126A (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Jan 7, 2025 08:58:59.217051029 CET1.1.1.1192.168.2.50xfa8dNo error (0)transfer.sh144.76.136.153A (IP address)IN (0x0001)false

                                                                                                                                                                                                                            HTTP Request Dependency Graph

                                                                                                                                                                                                                            • ip-api.com

                                                                                                                                                                                                                            HTTP Packets

                                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                            0192.168.2.549707208.95.112.1806008C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.305280924 CET167OUTGET /json/?fields=hosting,query HTTP/1.1
                                                                                                                                                                                                                            Host: ip-api.com
                                                                                                                                                                                                                            User-Agent: python-requests/2.32.3
                                                                                                                                                                                                                            Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                                            Connection: keep-alive
                                                                                                                                                                                                                            Jan 7, 2025 08:58:12.779674053 CET216INHTTP/1.1 200 OK
                                                                                                                                                                                                                            Date: Tue, 07 Jan 2025 07:58:12 GMT
                                                                                                                                                                                                                            Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                            Content-Length: 40
                                                                                                                                                                                                                            Access-Control-Allow-Origin: *
                                                                                                                                                                                                                            X-Ttl: 60
                                                                                                                                                                                                                            X-Rl: 44
                                                                                                                                                                                                                            Data Raw: 7b 22 68 6f 73 74 69 6e 67 22 3a 66 61 6c 73 65 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d
                                                                                                                                                                                                                            Data Ascii: {"hosting":false,"query":"8.46.123.189"}


                                                                                                                                                                                                                            Statistics

                                                                                                                                                                                                                            CPU Usage

                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                            Memory Usage

                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                                                            Behavior

                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                            System Behavior

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                                                            Start time:02:57:59
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\1.exe"
                                                                                                                                                                                                                            Imagebase:0x7ff7e1950000
                                                                                                                                                                                                                            File size:25'435'744 bytes
                                                                                                                                                                                                                            MD5 hash:3689DACE869ABBBE4E87F57078F6BEC9
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:2
                                                                                                                                                                                                                            Start time:02:58:03
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\1.exe"
                                                                                                                                                                                                                            Imagebase:0x7ff7e1950000
                                                                                                                                                                                                                            File size:25'435'744 bytes
                                                                                                                                                                                                                            MD5 hash:3689DACE869ABBBE4E87F57078F6BEC9
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:3
                                                                                                                                                                                                                            Start time:02:58:05
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                            Imagebase:0x7ff7f3620000
                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:4
                                                                                                                                                                                                                            Start time:02:58:05
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:5
                                                                                                                                                                                                                            Start time:02:58:08
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:wmic path win32_VideoController get name
                                                                                                                                                                                                                            Imagebase:0x7ff62e690000
                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:6
                                                                                                                                                                                                                            Start time:02:58:08
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:7
                                                                                                                                                                                                                            Start time:02:58:08
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:wmic csproduct get uuid
                                                                                                                                                                                                                            Imagebase:0x7ff62e690000
                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:8
                                                                                                                                                                                                                            Start time:02:58:08
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:9
                                                                                                                                                                                                                            Start time:02:58:09
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul
                                                                                                                                                                                                                            Imagebase:0x7ff7f3620000
                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:10
                                                                                                                                                                                                                            Start time:02:58:09
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:11
                                                                                                                                                                                                                            Start time:02:58:09
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\reg.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
                                                                                                                                                                                                                            Imagebase:0x7ff6d5880000
                                                                                                                                                                                                                            File size:77'312 bytes
                                                                                                                                                                                                                            MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:12
                                                                                                                                                                                                                            Start time:02:58:09
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul
                                                                                                                                                                                                                            Imagebase:0x7ff7f3620000
                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:13
                                                                                                                                                                                                                            Start time:02:58:09
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:14
                                                                                                                                                                                                                            Start time:02:58:09
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\reg.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName
                                                                                                                                                                                                                            Imagebase:0x7ff6d5880000
                                                                                                                                                                                                                            File size:77'312 bytes
                                                                                                                                                                                                                            MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:15
                                                                                                                                                                                                                            Start time:02:58:11
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                                                                                                                                                            Imagebase:0x7ff7f3620000
                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:16
                                                                                                                                                                                                                            Start time:02:58:11
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                            Imagebase:0x7ff7f3620000
                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:17
                                                                                                                                                                                                                            Start time:02:58:11
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:18
                                                                                                                                                                                                                            Start time:02:58:11
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:19
                                                                                                                                                                                                                            Start time:02:58:11
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                                                                                                                                                            Imagebase:0x7ff7f3620000
                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:20
                                                                                                                                                                                                                            Start time:02:58:11
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:21
                                                                                                                                                                                                                            Start time:02:58:11
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:powershell Get-Clipboard
                                                                                                                                                                                                                            Imagebase:0x7ff7be880000
                                                                                                                                                                                                                            File size:452'608 bytes
                                                                                                                                                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:22
                                                                                                                                                                                                                            Start time:02:58:11
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:tasklist
                                                                                                                                                                                                                            Imagebase:0x7ff67da20000
                                                                                                                                                                                                                            File size:106'496 bytes
                                                                                                                                                                                                                            MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:23
                                                                                                                                                                                                                            Start time:02:58:11
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                                                                                                                                                            Imagebase:0x7ff62e690000
                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:24
                                                                                                                                                                                                                            Start time:02:58:12
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "taskkill /f /im exodus.exe"
                                                                                                                                                                                                                            Imagebase:0x7ff7f3620000
                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:25
                                                                                                                                                                                                                            Start time:02:58:12
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:26
                                                                                                                                                                                                                            Start time:02:58:13
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:taskkill /f /im exodus.exe
                                                                                                                                                                                                                            Imagebase:0x7ff7daef0000
                                                                                                                                                                                                                            File size:101'376 bytes
                                                                                                                                                                                                                            MD5 hash:A599D3B2FAFBDE4C1A6D7D0F839451C7
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:27
                                                                                                                                                                                                                            Start time:02:58:14
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                                                            Imagebase:0x7ff7be880000
                                                                                                                                                                                                                            File size:452'608 bytes
                                                                                                                                                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:28
                                                                                                                                                                                                                            Start time:02:58:15
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:30
                                                                                                                                                                                                                            Start time:02:58:27
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
                                                                                                                                                                                                                            Imagebase:0x7ff7be880000
                                                                                                                                                                                                                            File size:452'608 bytes
                                                                                                                                                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:31
                                                                                                                                                                                                                            Start time:02:58:27
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:32
                                                                                                                                                                                                                            Start time:02:58:45
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:wmic cpu get name
                                                                                                                                                                                                                            Imagebase:0x7ff62e690000
                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:33
                                                                                                                                                                                                                            Start time:02:58:45
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff632ac0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:35
                                                                                                                                                                                                                            Start time:02:58:46
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:wmic path win32_VideoController get name
                                                                                                                                                                                                                            Imagebase:0x7ff62e690000
                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:36
                                                                                                                                                                                                                            Start time:02:58:46
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:37
                                                                                                                                                                                                                            Start time:02:58:47
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:wmic computersystem get TotalPhysicalMemory
                                                                                                                                                                                                                            Imagebase:0x7ff62e690000
                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:38
                                                                                                                                                                                                                            Start time:02:58:47
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:39
                                                                                                                                                                                                                            Start time:02:58:48
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                                                                                                            Imagebase:0x7ff7f3620000
                                                                                                                                                                                                                            File size:289'792 bytes
                                                                                                                                                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:40
                                                                                                                                                                                                                            Start time:02:58:48
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                            File size:862'208 bytes
                                                                                                                                                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:41
                                                                                                                                                                                                                            Start time:02:58:48
                                                                                                                                                                                                                            Start date:07/01/2025
                                                                                                                                                                                                                            Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                                                                                                                                                                                                                            Imagebase:0x7ff62e690000
                                                                                                                                                                                                                            File size:576'000 bytes
                                                                                                                                                                                                                            MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            Disassembly

                                                                                                                                                                                                                            Reset < >

                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                              Execution Coverage:10.4%
                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                              Signature Coverage:19.6%
                                                                                                                                                                                                                              Total number of Nodes:2000
                                                                                                                                                                                                                              Total number of Limit Nodes:57
                                                                                                                                                                                                                              execution_graph 18515 7ff7e1964938 18516 7ff7e196496f 18515->18516 18517 7ff7e1964952 18515->18517 18516->18517 18519 7ff7e1964982 CreateFileW 18516->18519 18518 7ff7e19643d4 _fread_nolock 11 API calls 18517->18518 18520 7ff7e1964957 18518->18520 18521 7ff7e19649ec 18519->18521 18522 7ff7e19649b6 18519->18522 18525 7ff7e19643f4 _get_daylight 11 API calls 18520->18525 18566 7ff7e1964f14 18521->18566 18540 7ff7e1964a8c GetFileType 18522->18540 18528 7ff7e196495f 18525->18528 18533 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18528->18533 18529 7ff7e19649cb CloseHandle 18536 7ff7e196496a 18529->18536 18530 7ff7e19649e1 CloseHandle 18530->18536 18531 7ff7e19649f5 18534 7ff7e1964368 _fread_nolock 11 API calls 18531->18534 18532 7ff7e1964a20 18587 7ff7e1964cd4 18532->18587 18533->18536 18539 7ff7e19649ff 18534->18539 18539->18536 18541 7ff7e1964b97 18540->18541 18542 7ff7e1964ada 18540->18542 18544 7ff7e1964b9f 18541->18544 18545 7ff7e1964bc1 18541->18545 18543 7ff7e1964b06 GetFileInformationByHandle 18542->18543 18547 7ff7e1964e10 21 API calls 18542->18547 18548 7ff7e1964b2f 18543->18548 18549 7ff7e1964bb2 GetLastError 18543->18549 18544->18549 18550 7ff7e1964ba3 18544->18550 18546 7ff7e1964be4 PeekNamedPipe 18545->18546 18557 7ff7e1964b82 18545->18557 18546->18557 18551 7ff7e1964af4 18547->18551 18552 7ff7e1964cd4 51 API calls 18548->18552 18554 7ff7e1964368 _fread_nolock 11 API calls 18549->18554 18553 7ff7e19643f4 _get_daylight 11 API calls 18550->18553 18551->18543 18551->18557 18556 7ff7e1964b3a 18552->18556 18553->18557 18554->18557 18555 7ff7e195b870 _log10_special 8 API calls 18558 7ff7e19649c4 18555->18558 18604 7ff7e1964c34 18556->18604 18557->18555 18558->18529 18558->18530 18561 7ff7e1964c34 10 API calls 18562 7ff7e1964b59 18561->18562 18563 7ff7e1964c34 10 API calls 18562->18563 18564 7ff7e1964b6a 18563->18564 18564->18557 18565 7ff7e19643f4 _get_daylight 11 API calls 18564->18565 18565->18557 18567 7ff7e1964f4a 18566->18567 18568 7ff7e19643f4 _get_daylight 11 API calls 18567->18568 18586 7ff7e1964fe2 __std_exception_destroy 18567->18586 18570 7ff7e1964f5c 18568->18570 18569 7ff7e195b870 _log10_special 8 API calls 18571 7ff7e19649f1 18569->18571 18572 7ff7e19643f4 _get_daylight 11 API calls 18570->18572 18571->18531 18571->18532 18573 7ff7e1964f64 18572->18573 18574 7ff7e1967118 45 API calls 18573->18574 18575 7ff7e1964f79 18574->18575 18576 7ff7e1964f8b 18575->18576 18577 7ff7e1964f81 18575->18577 18579 7ff7e19643f4 _get_daylight 11 API calls 18576->18579 18578 7ff7e19643f4 _get_daylight 11 API calls 18577->18578 18583 7ff7e1964f86 18578->18583 18580 7ff7e1964f90 18579->18580 18581 7ff7e19643f4 _get_daylight 11 API calls 18580->18581 18580->18586 18582 7ff7e1964f9a 18581->18582 18585 7ff7e1967118 45 API calls 18582->18585 18584 7ff7e1964fd4 GetDriveTypeW 18583->18584 18583->18586 18584->18586 18585->18583 18586->18569 18589 7ff7e1964cfc 18587->18589 18588 7ff7e1964a2d 18597 7ff7e1964e10 18588->18597 18589->18588 18611 7ff7e196ea34 18589->18611 18591 7ff7e1964d90 18591->18588 18592 7ff7e196ea34 51 API calls 18591->18592 18593 7ff7e1964da3 18592->18593 18593->18588 18594 7ff7e196ea34 51 API calls 18593->18594 18595 7ff7e1964db6 18594->18595 18595->18588 18596 7ff7e196ea34 51 API calls 18595->18596 18596->18588 18598 7ff7e1964e2a 18597->18598 18599 7ff7e1964e61 18598->18599 18600 7ff7e1964e3a 18598->18600 18601 7ff7e196e8c8 21 API calls 18599->18601 18602 7ff7e1964368 _fread_nolock 11 API calls 18600->18602 18603 7ff7e1964e4a 18600->18603 18601->18603 18602->18603 18603->18539 18605 7ff7e1964c5d FileTimeToSystemTime 18604->18605 18606 7ff7e1964c50 18604->18606 18607 7ff7e1964c71 SystemTimeToTzSpecificLocalTime 18605->18607 18608 7ff7e1964c58 18605->18608 18606->18605 18606->18608 18607->18608 18609 7ff7e195b870 _log10_special 8 API calls 18608->18609 18610 7ff7e1964b49 18609->18610 18610->18561 18612 7ff7e196ea65 18611->18612 18613 7ff7e196ea41 18611->18613 18616 7ff7e196ea9f 18612->18616 18619 7ff7e196eabe 18612->18619 18613->18612 18614 7ff7e196ea46 18613->18614 18615 7ff7e19643f4 _get_daylight 11 API calls 18614->18615 18617 7ff7e196ea4b 18615->18617 18618 7ff7e19643f4 _get_daylight 11 API calls 18616->18618 18621 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18617->18621 18622 7ff7e196eaa4 18618->18622 18620 7ff7e1964178 45 API calls 18619->18620 18627 7ff7e196eacb 18620->18627 18623 7ff7e196ea56 18621->18623 18624 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18622->18624 18623->18591 18625 7ff7e196eaaf 18624->18625 18625->18591 18626 7ff7e196f7ec 51 API calls 18626->18627 18627->18625 18627->18626 19343 7ff7e19709c0 19354 7ff7e19766f4 19343->19354 19355 7ff7e1976701 19354->19355 19356 7ff7e1969c58 __free_lconv_num 11 API calls 19355->19356 19357 7ff7e197671d 19355->19357 19356->19355 19358 7ff7e1969c58 __free_lconv_num 11 API calls 19357->19358 19359 7ff7e19709c9 19357->19359 19358->19357 19360 7ff7e196f5e8 EnterCriticalSection 19359->19360 18461 7ff7e196ec9c 18462 7ff7e196ee8e 18461->18462 18464 7ff7e196ecde _isindst 18461->18464 18463 7ff7e19643f4 _get_daylight 11 API calls 18462->18463 18481 7ff7e196ee7e 18463->18481 18464->18462 18467 7ff7e196ed5e _isindst 18464->18467 18465 7ff7e195b870 _log10_special 8 API calls 18466 7ff7e196eea9 18465->18466 18482 7ff7e19754a4 18467->18482 18472 7ff7e196eeba 18474 7ff7e1969c10 _isindst 17 API calls 18472->18474 18476 7ff7e196eece 18474->18476 18479 7ff7e196edbb 18479->18481 18506 7ff7e19754e8 18479->18506 18481->18465 18483 7ff7e19754b3 18482->18483 18487 7ff7e196ed7c 18482->18487 18513 7ff7e196f5e8 EnterCriticalSection 18483->18513 18488 7ff7e19748a8 18487->18488 18489 7ff7e19748b1 18488->18489 18491 7ff7e196ed91 18488->18491 18490 7ff7e19643f4 _get_daylight 11 API calls 18489->18490 18492 7ff7e19748b6 18490->18492 18491->18472 18494 7ff7e19748d8 18491->18494 18493 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18492->18493 18493->18491 18495 7ff7e19748e1 18494->18495 18499 7ff7e196eda2 18494->18499 18496 7ff7e19643f4 _get_daylight 11 API calls 18495->18496 18497 7ff7e19748e6 18496->18497 18498 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18497->18498 18498->18499 18499->18472 18500 7ff7e1974908 18499->18500 18501 7ff7e196edb3 18500->18501 18502 7ff7e1974911 18500->18502 18501->18472 18501->18479 18503 7ff7e19643f4 _get_daylight 11 API calls 18502->18503 18504 7ff7e1974916 18503->18504 18505 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18504->18505 18505->18501 18514 7ff7e196f5e8 EnterCriticalSection 18506->18514 19977 7ff7e1964720 19978 7ff7e196472b 19977->19978 19986 7ff7e196e5b4 19978->19986 19999 7ff7e196f5e8 EnterCriticalSection 19986->19999 20028 7ff7e196b830 20039 7ff7e196f5e8 EnterCriticalSection 20028->20039 18628 7ff7e1968c79 18629 7ff7e19696e8 45 API calls 18628->18629 18630 7ff7e1968c7e 18629->18630 18631 7ff7e1968ca5 GetModuleHandleW 18630->18631 18632 7ff7e1968cef 18630->18632 18631->18632 18638 7ff7e1968cb2 18631->18638 18640 7ff7e1968b7c 18632->18640 18638->18632 18654 7ff7e1968da0 GetModuleHandleExW 18638->18654 18660 7ff7e196f5e8 EnterCriticalSection 18640->18660 18655 7ff7e1968dfd 18654->18655 18656 7ff7e1968dd4 GetProcAddress 18654->18656 18658 7ff7e1968e09 18655->18658 18659 7ff7e1968e02 FreeLibrary 18655->18659 18657 7ff7e1968de6 18656->18657 18657->18655 18658->18632 18659->18658 20049 7ff7e197a079 20052 7ff7e1964788 LeaveCriticalSection 20049->20052 19309 7ff7e195ae00 19310 7ff7e195ae2e 19309->19310 19311 7ff7e195ae15 19309->19311 19311->19310 19313 7ff7e196c90c 12 API calls 19311->19313 19312 7ff7e195ae8e 19313->19312 19755 7ff7e197a10e 19756 7ff7e197a11d 19755->19756 19758 7ff7e197a127 19755->19758 19759 7ff7e196f648 LeaveCriticalSection 19756->19759 15755 7ff7e195bf5c 15776 7ff7e195c12c 15755->15776 15758 7ff7e195c0a8 15899 7ff7e195c44c IsProcessorFeaturePresent 15758->15899 15759 7ff7e195bf78 __scrt_acquire_startup_lock 15761 7ff7e195c0b2 15759->15761 15768 7ff7e195bf96 __scrt_release_startup_lock 15759->15768 15762 7ff7e195c44c 7 API calls 15761->15762 15764 7ff7e195c0bd __FrameHandler3::FrameUnwindToEmptyState 15762->15764 15763 7ff7e195bfbb 15765 7ff7e195c041 15782 7ff7e195c594 15765->15782 15767 7ff7e195c046 15785 7ff7e1951000 15767->15785 15768->15763 15768->15765 15888 7ff7e1968e44 15768->15888 15773 7ff7e195c069 15773->15764 15895 7ff7e195c2b0 15773->15895 15777 7ff7e195c134 15776->15777 15778 7ff7e195c140 __scrt_dllmain_crt_thread_attach 15777->15778 15779 7ff7e195c14d 15778->15779 15781 7ff7e195bf70 15778->15781 15779->15781 15906 7ff7e195cba8 15779->15906 15781->15758 15781->15759 15933 7ff7e19797e0 15782->15933 15784 7ff7e195c5ab GetStartupInfoW 15784->15767 15786 7ff7e1951009 15785->15786 15935 7ff7e1964794 15786->15935 15788 7ff7e195352b 15942 7ff7e19533e0 15788->15942 15795 7ff7e195356c 15797 7ff7e1951bf0 49 API calls 15795->15797 15796 7ff7e1953736 16142 7ff7e1953f70 15796->16142 15814 7ff7e1953588 15797->15814 15800 7ff7e1953785 15802 7ff7e19525f0 53 API calls 15800->15802 15879 7ff7e1953538 15802->15879 15804 7ff7e195365f __std_exception_destroy 15810 7ff7e1953834 15804->15810 15812 7ff7e1957e10 14 API calls 15804->15812 15805 7ff7e1953778 15806 7ff7e195377d 15805->15806 15807 7ff7e195379f 15805->15807 16161 7ff7e195f36c 15806->16161 15809 7ff7e1951bf0 49 API calls 15807->15809 15811 7ff7e19537be 15809->15811 15837 7ff7e1953805 __std_exception_destroy 15810->15837 16165 7ff7e1953e90 15810->16165 15822 7ff7e19518f0 115 API calls 15811->15822 15815 7ff7e19536ae 15812->15815 16004 7ff7e1957e10 15814->16004 16017 7ff7e1957f80 15815->16017 15816 7ff7e1953852 15818 7ff7e1953865 15816->15818 15819 7ff7e1953871 15816->15819 16168 7ff7e1953fe0 15818->16168 15821 7ff7e1951bf0 49 API calls 15819->15821 15821->15837 15824 7ff7e19537df 15822->15824 15823 7ff7e19536bd 15825 7ff7e195380f 15823->15825 15826 7ff7e19536cf 15823->15826 15824->15814 15829 7ff7e19537ef 15824->15829 16026 7ff7e1958400 15825->16026 16022 7ff7e1951bf0 15826->16022 15833 7ff7e19525f0 53 API calls 15829->15833 15832 7ff7e195389e SetDllDirectoryW 15839 7ff7e19538c3 15832->15839 15833->15879 15836 7ff7e19536fc 16122 7ff7e19525f0 15836->16122 16077 7ff7e19586b0 15837->16077 15841 7ff7e1953a50 15839->15841 16082 7ff7e1956560 15839->16082 15843 7ff7e1953a7d 15841->15843 15844 7ff7e1953a5a PostMessageW GetMessageW 15841->15844 16226 7ff7e1953080 15843->16226 15844->15843 15847 7ff7e19538ea 15849 7ff7e1953947 15847->15849 15854 7ff7e1953901 15847->15854 16171 7ff7e19565a0 15847->16171 15849->15841 15855 7ff7e195395c 15849->15855 15863 7ff7e1953905 15854->15863 16192 7ff7e1956970 15854->16192 16102 7ff7e19530e0 15855->16102 15859 7ff7e1956780 FreeLibrary 15860 7ff7e1953aa3 15859->15860 15863->15849 16208 7ff7e1952870 15863->16208 16133 7ff7e195b870 15879->16133 15889 7ff7e1968e5b 15888->15889 15890 7ff7e1968e7c 15888->15890 15889->15765 18412 7ff7e19696e8 15890->18412 15893 7ff7e195c5d8 GetModuleHandleW 15894 7ff7e195c5e9 15893->15894 15894->15773 15896 7ff7e195c2c1 15895->15896 15897 7ff7e195c080 15896->15897 15898 7ff7e195cba8 7 API calls 15896->15898 15897->15763 15898->15897 15900 7ff7e195c472 memcpy_s __FrameHandler3::FrameUnwindToEmptyState 15899->15900 15901 7ff7e195c491 RtlCaptureContext RtlLookupFunctionEntry 15900->15901 15902 7ff7e195c4ba RtlVirtualUnwind 15901->15902 15903 7ff7e195c4f6 memcpy_s 15901->15903 15902->15903 15904 7ff7e195c528 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15903->15904 15905 7ff7e195c576 __FrameHandler3::FrameUnwindToEmptyState 15904->15905 15905->15761 15907 7ff7e195cbba 15906->15907 15908 7ff7e195cbb0 15906->15908 15907->15781 15912 7ff7e195cf44 15908->15912 15913 7ff7e195cf53 15912->15913 15914 7ff7e195cbb5 15912->15914 15920 7ff7e195d180 15913->15920 15916 7ff7e195cfb0 15914->15916 15917 7ff7e195cfdb 15916->15917 15918 7ff7e195cfbe DeleteCriticalSection 15917->15918 15919 7ff7e195cfdf 15917->15919 15918->15917 15919->15907 15924 7ff7e195cfe8 15920->15924 15925 7ff7e195d0d2 TlsFree 15924->15925 15927 7ff7e195d02c __vcrt_InitializeCriticalSectionEx 15924->15927 15926 7ff7e195d05a LoadLibraryExW 15929 7ff7e195d07b GetLastError 15926->15929 15930 7ff7e195d0f9 15926->15930 15927->15925 15927->15926 15928 7ff7e195d119 GetProcAddress 15927->15928 15932 7ff7e195d09d LoadLibraryExW 15927->15932 15928->15925 15929->15927 15930->15928 15931 7ff7e195d110 FreeLibrary 15930->15931 15931->15928 15932->15927 15932->15930 15934 7ff7e19797d0 15933->15934 15934->15784 15934->15934 15937 7ff7e196e790 15935->15937 15936 7ff7e196e7e3 16239 7ff7e1969b24 15936->16239 15937->15936 15939 7ff7e196e836 15937->15939 16249 7ff7e196e668 15939->16249 15940 7ff7e196e80c 15940->15788 16356 7ff7e195bb70 15942->16356 15945 7ff7e195341b 16363 7ff7e19529e0 15945->16363 15946 7ff7e1953438 16358 7ff7e19585a0 FindFirstFileExW 15946->16358 15949 7ff7e195342e 15954 7ff7e195b870 _log10_special 8 API calls 15949->15954 15951 7ff7e195344b 16373 7ff7e1958620 CreateFileW 15951->16373 15952 7ff7e19534a5 16382 7ff7e1958760 15952->16382 15957 7ff7e19534dd 15954->15957 15956 7ff7e19534b3 15956->15949 15961 7ff7e19526c0 49 API calls 15956->15961 15957->15879 15964 7ff7e19518f0 15957->15964 15959 7ff7e195345c 16376 7ff7e19526c0 15959->16376 15960 7ff7e1953474 __vcrt_InitializeCriticalSectionEx 15960->15952 15961->15949 15965 7ff7e1953f70 108 API calls 15964->15965 15966 7ff7e1951925 15965->15966 15967 7ff7e1951bb6 15966->15967 15969 7ff7e19576a0 83 API calls 15966->15969 15968 7ff7e195b870 _log10_special 8 API calls 15967->15968 15971 7ff7e1951bd1 15968->15971 15970 7ff7e195196b 15969->15970 16003 7ff7e195199c 15970->16003 16787 7ff7e195f9f4 15970->16787 15971->15795 15971->15796 15973 7ff7e195f36c 74 API calls 15973->15967 15974 7ff7e1951985 15975 7ff7e1951989 15974->15975 15976 7ff7e19519a1 15974->15976 16794 7ff7e1952760 15975->16794 16791 7ff7e195f6bc 15976->16791 15980 7ff7e19519d7 15983 7ff7e19519ee 15980->15983 15984 7ff7e1951a06 15980->15984 15981 7ff7e19519bf 15982 7ff7e1952760 53 API calls 15981->15982 15982->16003 15985 7ff7e1952760 53 API calls 15983->15985 15986 7ff7e1951bf0 49 API calls 15984->15986 15985->16003 15987 7ff7e1951a1d 15986->15987 15988 7ff7e1951bf0 49 API calls 15987->15988 15989 7ff7e1951a68 15988->15989 15990 7ff7e195f9f4 73 API calls 15989->15990 15991 7ff7e1951a8c 15990->15991 15992 7ff7e1951ab9 15991->15992 15993 7ff7e1951aa1 15991->15993 15994 7ff7e195f6bc _fread_nolock 53 API calls 15992->15994 15995 7ff7e1952760 53 API calls 15993->15995 15996 7ff7e1951ace 15994->15996 15995->16003 15997 7ff7e1951aec 15996->15997 15998 7ff7e1951ad4 15996->15998 16811 7ff7e195f430 15997->16811 15999 7ff7e1952760 53 API calls 15998->15999 15999->16003 16002 7ff7e19525f0 53 API calls 16002->16003 16003->15973 16005 7ff7e1957e1a 16004->16005 16006 7ff7e19586b0 2 API calls 16005->16006 16007 7ff7e1957e39 GetEnvironmentVariableW 16006->16007 16008 7ff7e1957e56 ExpandEnvironmentStringsW 16007->16008 16009 7ff7e1957ea2 16007->16009 16008->16009 16010 7ff7e1957e78 16008->16010 16011 7ff7e195b870 _log10_special 8 API calls 16009->16011 16012 7ff7e1958760 2 API calls 16010->16012 16013 7ff7e1957eb4 16011->16013 16014 7ff7e1957e8a 16012->16014 16013->15804 16015 7ff7e195b870 _log10_special 8 API calls 16014->16015 16016 7ff7e1957e9a 16015->16016 16016->15804 16018 7ff7e19586b0 2 API calls 16017->16018 16019 7ff7e1957f94 16018->16019 17020 7ff7e1967548 16019->17020 16021 7ff7e1957fa6 __std_exception_destroy 16021->15823 16023 7ff7e1951c15 16022->16023 16024 7ff7e1963ca4 49 API calls 16023->16024 16025 7ff7e1951c38 16024->16025 16025->15836 16025->15837 16027 7ff7e1958415 16026->16027 17038 7ff7e1957b50 GetCurrentProcess OpenProcessToken 16027->17038 16030 7ff7e1957b50 7 API calls 16031 7ff7e1958441 16030->16031 16032 7ff7e195845a 16031->16032 16033 7ff7e1958474 16031->16033 16034 7ff7e1952590 48 API calls 16032->16034 16035 7ff7e1952590 48 API calls 16033->16035 16036 7ff7e1958472 16034->16036 16037 7ff7e1958487 LocalFree LocalFree 16035->16037 16036->16037 16038 7ff7e19584a3 16037->16038 16041 7ff7e19584af 16037->16041 17048 7ff7e1952940 16038->17048 16040 7ff7e195b870 _log10_special 8 API calls 16041->16040 16078 7ff7e19586d2 MultiByteToWideChar 16077->16078 16079 7ff7e19586f6 16077->16079 16078->16079 16081 7ff7e195870c __std_exception_destroy 16078->16081 16080 7ff7e1958713 MultiByteToWideChar 16079->16080 16079->16081 16080->16081 16081->15832 16083 7ff7e1956575 16082->16083 16084 7ff7e19538d5 16083->16084 16085 7ff7e1952760 53 API calls 16083->16085 16086 7ff7e1956b00 16084->16086 16085->16084 16087 7ff7e1956b4a __std_exception_destroy 16086->16087 16088 7ff7e1956b30 16086->16088 16087->15847 16088->16087 17332 7ff7e1951440 16088->17332 16090 7ff7e1956b54 16090->16087 16091 7ff7e1953fe0 49 API calls 16090->16091 16092 7ff7e1956b76 16091->16092 16093 7ff7e1956b7b 16092->16093 16094 7ff7e1953fe0 49 API calls 16092->16094 16095 7ff7e1952870 53 API calls 16093->16095 16096 7ff7e1956b9a 16094->16096 16095->16087 16096->16093 16097 7ff7e1953fe0 49 API calls 16096->16097 16098 7ff7e1956bb6 16097->16098 16098->16093 16099 7ff7e1956bbf 16098->16099 16113 7ff7e19530ee memcpy_s 16102->16113 16103 7ff7e195b870 _log10_special 8 API calls 16105 7ff7e195338e 16103->16105 16104 7ff7e19532e7 16104->16103 16105->15879 16121 7ff7e19583e0 LocalFree 16105->16121 16107 7ff7e1951bf0 49 API calls 16107->16113 16108 7ff7e1953309 16110 7ff7e19525f0 53 API calls 16108->16110 16110->16104 16112 7ff7e19532e9 16116 7ff7e19525f0 53 API calls 16112->16116 16113->16104 16113->16107 16113->16108 16113->16112 16115 7ff7e1952870 53 API calls 16113->16115 16119 7ff7e19532f7 16113->16119 17393 7ff7e1953f10 16113->17393 17399 7ff7e1957530 16113->17399 17410 7ff7e19515c0 16113->17410 17448 7ff7e19568e0 16113->17448 17452 7ff7e1953b40 16113->17452 17496 7ff7e1953e00 16113->17496 16115->16113 16116->16104 16120 7ff7e19525f0 53 API calls 16119->16120 16120->16104 16123 7ff7e195262a 16122->16123 16124 7ff7e1963ca4 49 API calls 16123->16124 16125 7ff7e1952652 16124->16125 16126 7ff7e19586b0 2 API calls 16125->16126 16127 7ff7e195266a 16126->16127 16128 7ff7e195268e MessageBoxA 16127->16128 16129 7ff7e1952677 MessageBoxW 16127->16129 16130 7ff7e19526a0 16128->16130 16129->16130 16134 7ff7e195b879 16133->16134 16135 7ff7e195372a 16134->16135 16136 7ff7e195bc00 IsProcessorFeaturePresent 16134->16136 16135->15893 16137 7ff7e195bc18 16136->16137 17632 7ff7e195bdf8 RtlCaptureContext 16137->17632 16143 7ff7e1953f7c 16142->16143 16144 7ff7e19586b0 2 API calls 16143->16144 16145 7ff7e1953fa4 16144->16145 16146 7ff7e19586b0 2 API calls 16145->16146 16147 7ff7e1953fb7 16146->16147 17637 7ff7e19652a4 16147->17637 16150 7ff7e195b870 _log10_special 8 API calls 16151 7ff7e1953746 16150->16151 16151->15800 16152 7ff7e19576a0 16151->16152 16153 7ff7e19576c4 16152->16153 16154 7ff7e195f9f4 73 API calls 16153->16154 16157 7ff7e195779b __std_exception_destroy 16153->16157 16155 7ff7e19576e0 16154->16155 16155->16157 18028 7ff7e1966bd8 16155->18028 16157->15805 16158 7ff7e195f9f4 73 API calls 16160 7ff7e19576f5 16158->16160 16159 7ff7e195f6bc _fread_nolock 53 API calls 16159->16160 16160->16157 16160->16158 16160->16159 16162 7ff7e195f39c 16161->16162 18043 7ff7e195f148 16162->18043 16164 7ff7e195f3b5 16164->15800 16166 7ff7e1951bf0 49 API calls 16165->16166 16167 7ff7e1953ead 16166->16167 16167->15816 16169 7ff7e1951bf0 49 API calls 16168->16169 16170 7ff7e1954010 16169->16170 16170->15837 16181 7ff7e19565bc 16171->16181 16172 7ff7e195b870 _log10_special 8 API calls 16173 7ff7e19566f1 16172->16173 16173->15854 16174 7ff7e19517e0 45 API calls 16174->16181 16175 7ff7e195675d 16177 7ff7e19525f0 53 API calls 16175->16177 16176 7ff7e1951bf0 49 API calls 16176->16181 16189 7ff7e19566df 16177->16189 16178 7ff7e195674a 16180 7ff7e19525f0 53 API calls 16178->16180 16179 7ff7e1953f10 10 API calls 16179->16181 16180->16189 16181->16174 16181->16175 16181->16176 16181->16178 16181->16179 16182 7ff7e195670d 16181->16182 16183 7ff7e1957530 52 API calls 16181->16183 16185 7ff7e1952870 53 API calls 16181->16185 16186 7ff7e1956737 16181->16186 16187 7ff7e19515c0 118 API calls 16181->16187 16181->16189 16190 7ff7e1956720 16181->16190 16184 7ff7e19525f0 53 API calls 16182->16184 16183->16181 16184->16189 16185->16181 16188 7ff7e19525f0 53 API calls 16186->16188 16187->16181 16188->16189 16189->16172 16191 7ff7e19525f0 53 API calls 16190->16191 16191->16189 18054 7ff7e19581a0 16192->18054 16194 7ff7e1956989 16195 7ff7e19581a0 3 API calls 16194->16195 16196 7ff7e195699c 16195->16196 16197 7ff7e19569cf 16196->16197 16198 7ff7e19569b4 16196->16198 16199 7ff7e19525f0 53 API calls 16197->16199 18058 7ff7e1956ea0 GetProcAddress 16198->18058 16201 7ff7e1953916 16199->16201 16201->15863 16202 7ff7e1956cd0 16201->16202 16203 7ff7e1956ced 16202->16203 16209 7ff7e19528aa 16208->16209 16210 7ff7e1963ca4 49 API calls 16209->16210 16211 7ff7e19528d2 16210->16211 16212 7ff7e19586b0 2 API calls 16211->16212 16213 7ff7e19528ea 16212->16213 16214 7ff7e195290e MessageBoxA 16213->16214 16215 7ff7e19528f7 MessageBoxW 16213->16215 16216 7ff7e1952920 16214->16216 16215->16216 16217 7ff7e195b870 _log10_special 8 API calls 16216->16217 16218 7ff7e1952930 16217->16218 16219 7ff7e1956780 16218->16219 16220 7ff7e19568d6 16219->16220 16225 7ff7e1956792 16219->16225 16220->15849 18123 7ff7e1955af0 16226->18123 16234 7ff7e19530b9 16235 7ff7e19533a0 16234->16235 16236 7ff7e19533ae 16235->16236 16237 7ff7e19533bf 16236->16237 18411 7ff7e1958180 FreeLibrary 16236->18411 16237->15859 16256 7ff7e196986c 16239->16256 16243 7ff7e1969b5f 16243->15940 16355 7ff7e196477c EnterCriticalSection 16249->16355 16257 7ff7e1969888 GetLastError 16256->16257 16258 7ff7e19698c3 16256->16258 16259 7ff7e1969898 16257->16259 16258->16243 16262 7ff7e19698d8 16258->16262 16269 7ff7e196a6a0 16259->16269 16263 7ff7e196990c 16262->16263 16264 7ff7e19698f4 GetLastError SetLastError 16262->16264 16263->16243 16265 7ff7e1969c10 IsProcessorFeaturePresent 16263->16265 16264->16263 16266 7ff7e1969c23 16265->16266 16347 7ff7e1969924 16266->16347 16270 7ff7e196a6da FlsSetValue 16269->16270 16271 7ff7e196a6bf FlsGetValue 16269->16271 16273 7ff7e196a6e7 16270->16273 16274 7ff7e19698b3 SetLastError 16270->16274 16272 7ff7e196a6d4 16271->16272 16271->16274 16272->16270 16286 7ff7e196dea8 16273->16286 16274->16258 16277 7ff7e196a714 FlsSetValue 16280 7ff7e196a732 16277->16280 16281 7ff7e196a720 FlsSetValue 16277->16281 16278 7ff7e196a704 FlsSetValue 16279 7ff7e196a70d 16278->16279 16293 7ff7e1969c58 16279->16293 16299 7ff7e196a204 16280->16299 16281->16279 16290 7ff7e196deb9 _get_daylight 16286->16290 16287 7ff7e196df0a 16307 7ff7e19643f4 16287->16307 16288 7ff7e196deee HeapAlloc 16288->16290 16291 7ff7e196a6f6 16288->16291 16290->16287 16290->16288 16304 7ff7e19728a0 16290->16304 16291->16277 16291->16278 16294 7ff7e1969c5d RtlFreeHeap 16293->16294 16298 7ff7e1969c8c 16293->16298 16295 7ff7e1969c78 GetLastError 16294->16295 16294->16298 16296 7ff7e1969c85 __free_lconv_num 16295->16296 16297 7ff7e19643f4 _get_daylight 9 API calls 16296->16297 16297->16298 16298->16274 16333 7ff7e196a0dc 16299->16333 16310 7ff7e19728e0 16304->16310 16316 7ff7e196a5d8 GetLastError 16307->16316 16309 7ff7e19643fd 16309->16291 16315 7ff7e196f5e8 EnterCriticalSection 16310->16315 16317 7ff7e196a619 FlsSetValue 16316->16317 16321 7ff7e196a5fc 16316->16321 16318 7ff7e196a62b 16317->16318 16330 7ff7e196a609 16317->16330 16320 7ff7e196dea8 _get_daylight 5 API calls 16318->16320 16319 7ff7e196a685 SetLastError 16319->16309 16322 7ff7e196a63a 16320->16322 16321->16317 16321->16330 16323 7ff7e196a658 FlsSetValue 16322->16323 16324 7ff7e196a648 FlsSetValue 16322->16324 16326 7ff7e196a676 16323->16326 16327 7ff7e196a664 FlsSetValue 16323->16327 16325 7ff7e196a651 16324->16325 16328 7ff7e1969c58 __free_lconv_num 5 API calls 16325->16328 16329 7ff7e196a204 _get_daylight 5 API calls 16326->16329 16327->16325 16328->16330 16331 7ff7e196a67e 16329->16331 16330->16319 16332 7ff7e1969c58 __free_lconv_num 5 API calls 16331->16332 16332->16319 16345 7ff7e196f5e8 EnterCriticalSection 16333->16345 16348 7ff7e196995e memcpy_s __FrameHandler3::FrameUnwindToEmptyState 16347->16348 16349 7ff7e1969986 RtlCaptureContext RtlLookupFunctionEntry 16348->16349 16350 7ff7e19699f6 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16349->16350 16351 7ff7e19699c0 RtlVirtualUnwind 16349->16351 16352 7ff7e1969a48 __FrameHandler3::FrameUnwindToEmptyState 16350->16352 16351->16350 16353 7ff7e195b870 _log10_special 8 API calls 16352->16353 16354 7ff7e1969a67 GetCurrentProcess TerminateProcess 16353->16354 16357 7ff7e19533ec GetModuleFileNameW 16356->16357 16357->15945 16357->15946 16359 7ff7e19585df FindClose 16358->16359 16360 7ff7e19585f2 16358->16360 16359->16360 16361 7ff7e195b870 _log10_special 8 API calls 16360->16361 16362 7ff7e1953442 16361->16362 16362->15951 16362->15952 16364 7ff7e195bb70 16363->16364 16365 7ff7e19529fc GetLastError 16364->16365 16366 7ff7e1952a29 16365->16366 16387 7ff7e1963ef8 16366->16387 16371 7ff7e195b870 _log10_special 8 API calls 16372 7ff7e1952ae5 16371->16372 16372->15949 16374 7ff7e1953458 16373->16374 16375 7ff7e1958660 GetFinalPathNameByHandleW CloseHandle 16373->16375 16374->15959 16374->15960 16375->16374 16377 7ff7e19526fa 16376->16377 16378 7ff7e1963ef8 48 API calls 16377->16378 16379 7ff7e1952722 MessageBoxW 16378->16379 16380 7ff7e195b870 _log10_special 8 API calls 16379->16380 16381 7ff7e195274c 16380->16381 16381->15949 16383 7ff7e195878a WideCharToMultiByte 16382->16383 16384 7ff7e19587b5 16382->16384 16383->16384 16386 7ff7e19587cb __std_exception_destroy 16383->16386 16385 7ff7e19587d2 WideCharToMultiByte 16384->16385 16384->16386 16385->16386 16386->15956 16388 7ff7e1963f52 16387->16388 16389 7ff7e1963f77 16388->16389 16391 7ff7e1963fb3 16388->16391 16390 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16389->16390 16393 7ff7e1963fa1 16390->16393 16409 7ff7e19622b0 16391->16409 16395 7ff7e195b870 _log10_special 8 API calls 16393->16395 16394 7ff7e1964094 16396 7ff7e1969c58 __free_lconv_num 11 API calls 16394->16396 16397 7ff7e1952a54 FormatMessageW 16395->16397 16396->16393 16405 7ff7e1952590 16397->16405 16399 7ff7e19640ba 16399->16394 16401 7ff7e19640c4 16399->16401 16400 7ff7e1964069 16402 7ff7e1969c58 __free_lconv_num 11 API calls 16400->16402 16404 7ff7e1969c58 __free_lconv_num 11 API calls 16401->16404 16402->16393 16403 7ff7e1964060 16403->16394 16403->16400 16404->16393 16406 7ff7e19525b5 16405->16406 16407 7ff7e1963ef8 48 API calls 16406->16407 16408 7ff7e19525d8 MessageBoxW 16407->16408 16408->16371 16410 7ff7e19622ee 16409->16410 16411 7ff7e19622de 16409->16411 16412 7ff7e19622f7 16410->16412 16417 7ff7e1962325 16410->16417 16413 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16411->16413 16414 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16412->16414 16415 7ff7e196231d 16413->16415 16414->16415 16415->16394 16415->16399 16415->16400 16415->16403 16417->16411 16417->16415 16420 7ff7e1962cc4 16417->16420 16453 7ff7e1962710 16417->16453 16490 7ff7e1961ea0 16417->16490 16421 7ff7e1962d77 16420->16421 16422 7ff7e1962d06 16420->16422 16425 7ff7e1962d7c 16421->16425 16426 7ff7e1962dd0 16421->16426 16423 7ff7e1962d0c 16422->16423 16424 7ff7e1962da1 16422->16424 16427 7ff7e1962d40 16423->16427 16428 7ff7e1962d11 16423->16428 16513 7ff7e1961074 16424->16513 16429 7ff7e1962d7e 16425->16429 16430 7ff7e1962db1 16425->16430 16432 7ff7e1962de7 16426->16432 16434 7ff7e1962dda 16426->16434 16439 7ff7e1962ddf 16426->16439 16435 7ff7e1962d17 16427->16435 16427->16439 16428->16432 16428->16435 16433 7ff7e1962d20 16429->16433 16442 7ff7e1962d8d 16429->16442 16520 7ff7e1960c64 16430->16520 16527 7ff7e19639cc 16432->16527 16452 7ff7e1962e10 16433->16452 16493 7ff7e1963478 16433->16493 16434->16424 16434->16439 16435->16433 16440 7ff7e1962d52 16435->16440 16449 7ff7e1962d3b 16435->16449 16439->16452 16531 7ff7e1961484 16439->16531 16440->16452 16503 7ff7e19637b4 16440->16503 16442->16424 16444 7ff7e1962d92 16442->16444 16444->16452 16509 7ff7e1963878 16444->16509 16445 7ff7e195b870 _log10_special 8 API calls 16447 7ff7e196310a 16445->16447 16447->16417 16451 7ff7e1962ffc 16449->16451 16449->16452 16538 7ff7e1963ae0 16449->16538 16451->16452 16544 7ff7e196dd18 16451->16544 16452->16445 16454 7ff7e196271e 16453->16454 16455 7ff7e1962734 16453->16455 16456 7ff7e1962d77 16454->16456 16457 7ff7e1962d06 16454->16457 16479 7ff7e1962774 16454->16479 16458 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16455->16458 16455->16479 16461 7ff7e1962d7c 16456->16461 16462 7ff7e1962dd0 16456->16462 16459 7ff7e1962d0c 16457->16459 16460 7ff7e1962da1 16457->16460 16458->16479 16463 7ff7e1962d40 16459->16463 16464 7ff7e1962d11 16459->16464 16467 7ff7e1961074 38 API calls 16460->16467 16465 7ff7e1962d7e 16461->16465 16466 7ff7e1962db1 16461->16466 16468 7ff7e1962de7 16462->16468 16470 7ff7e1962dda 16462->16470 16475 7ff7e1962ddf 16462->16475 16471 7ff7e1962d17 16463->16471 16463->16475 16464->16468 16464->16471 16469 7ff7e1962d20 16465->16469 16478 7ff7e1962d8d 16465->16478 16473 7ff7e1960c64 38 API calls 16466->16473 16486 7ff7e1962d3b 16467->16486 16472 7ff7e19639cc 45 API calls 16468->16472 16474 7ff7e1963478 47 API calls 16469->16474 16488 7ff7e1962e10 16469->16488 16470->16460 16470->16475 16471->16469 16476 7ff7e1962d52 16471->16476 16471->16486 16472->16486 16473->16486 16474->16486 16477 7ff7e1961484 38 API calls 16475->16477 16475->16488 16480 7ff7e19637b4 46 API calls 16476->16480 16476->16488 16477->16486 16478->16460 16481 7ff7e1962d92 16478->16481 16479->16417 16480->16486 16483 7ff7e1963878 37 API calls 16481->16483 16481->16488 16482 7ff7e195b870 _log10_special 8 API calls 16484 7ff7e196310a 16482->16484 16483->16486 16484->16417 16485 7ff7e1963ae0 45 API calls 16489 7ff7e1962ffc 16485->16489 16486->16485 16486->16488 16486->16489 16487 7ff7e196dd18 46 API calls 16487->16489 16488->16482 16489->16487 16489->16488 16770 7ff7e19602e8 16490->16770 16494 7ff7e196349e 16493->16494 16556 7ff7e195fea0 16494->16556 16499 7ff7e1963ae0 45 API calls 16502 7ff7e19635e3 16499->16502 16500 7ff7e1963671 16500->16449 16500->16500 16501 7ff7e1963ae0 45 API calls 16501->16500 16502->16500 16502->16501 16502->16502 16505 7ff7e19637e9 16503->16505 16504 7ff7e1963807 16507 7ff7e196dd18 46 API calls 16504->16507 16505->16504 16506 7ff7e1963ae0 45 API calls 16505->16506 16508 7ff7e196382e 16505->16508 16506->16504 16507->16508 16508->16449 16510 7ff7e1963899 16509->16510 16511 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16510->16511 16512 7ff7e19638ca 16510->16512 16511->16512 16512->16449 16514 7ff7e19610a7 16513->16514 16515 7ff7e19610d6 16514->16515 16517 7ff7e1961193 16514->16517 16519 7ff7e1961113 16515->16519 16702 7ff7e195ff48 16515->16702 16518 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16517->16518 16518->16519 16519->16449 16521 7ff7e1960c97 16520->16521 16522 7ff7e1960cc6 16521->16522 16524 7ff7e1960d83 16521->16524 16523 7ff7e195ff48 12 API calls 16522->16523 16526 7ff7e1960d03 16522->16526 16523->16526 16525 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16524->16525 16525->16526 16526->16449 16528 7ff7e1963a0f 16527->16528 16530 7ff7e1963a13 __crtLCMapStringW 16528->16530 16710 7ff7e1963a68 16528->16710 16530->16449 16532 7ff7e19614b7 16531->16532 16533 7ff7e19614e6 16532->16533 16536 7ff7e19615a3 16532->16536 16534 7ff7e1961523 16533->16534 16535 7ff7e195ff48 12 API calls 16533->16535 16534->16449 16535->16534 16537 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16536->16537 16537->16534 16539 7ff7e1963af7 16538->16539 16714 7ff7e196ccc8 16539->16714 16545 7ff7e196dd57 16544->16545 16547 7ff7e196dd49 16544->16547 16545->16451 16546 7ff7e196dd77 16549 7ff7e196dd88 16546->16549 16550 7ff7e196ddaf 16546->16550 16547->16545 16547->16546 16548 7ff7e1963ae0 45 API calls 16547->16548 16548->16546 16760 7ff7e196f3b0 16549->16760 16550->16545 16552 7ff7e196ddd9 16550->16552 16553 7ff7e196de3a 16550->16553 16552->16545 16763 7ff7e196ebb0 16552->16763 16554 7ff7e196ebb0 _fread_nolock MultiByteToWideChar 16553->16554 16554->16545 16557 7ff7e195fed7 16556->16557 16563 7ff7e195fec6 16556->16563 16557->16563 16586 7ff7e196c90c 16557->16586 16560 7ff7e195ff18 16562 7ff7e1969c58 __free_lconv_num 11 API calls 16560->16562 16561 7ff7e1969c58 __free_lconv_num 11 API calls 16561->16560 16562->16563 16564 7ff7e196d880 16563->16564 16565 7ff7e196d89d 16564->16565 16566 7ff7e196d8d0 16564->16566 16567 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16565->16567 16566->16565 16569 7ff7e196d902 16566->16569 16568 7ff7e19635c1 16567->16568 16568->16499 16568->16502 16575 7ff7e196da15 16569->16575 16581 7ff7e196d94a 16569->16581 16570 7ff7e196db07 16626 7ff7e196cd6c 16570->16626 16572 7ff7e196dacd 16619 7ff7e196d104 16572->16619 16574 7ff7e196da9c 16612 7ff7e196d3e4 16574->16612 16575->16570 16575->16572 16575->16574 16577 7ff7e196da5f 16575->16577 16578 7ff7e196da55 16575->16578 16602 7ff7e196d614 16577->16602 16578->16572 16580 7ff7e196da5a 16578->16580 16580->16574 16580->16577 16581->16568 16593 7ff7e19697b4 16581->16593 16584 7ff7e1969c10 _isindst 17 API calls 16585 7ff7e196db64 16584->16585 16587 7ff7e196c957 16586->16587 16591 7ff7e196c91b _get_daylight 16586->16591 16589 7ff7e19643f4 _get_daylight 11 API calls 16587->16589 16588 7ff7e196c93e HeapAlloc 16590 7ff7e195ff04 16588->16590 16588->16591 16589->16590 16590->16560 16590->16561 16591->16587 16591->16588 16592 7ff7e19728a0 _get_daylight 2 API calls 16591->16592 16592->16591 16594 7ff7e19697cb 16593->16594 16595 7ff7e19697c1 16593->16595 16596 7ff7e19643f4 _get_daylight 11 API calls 16594->16596 16595->16594 16600 7ff7e19697e6 16595->16600 16597 7ff7e19697d2 16596->16597 16635 7ff7e1969bf0 16597->16635 16599 7ff7e19697de 16599->16568 16599->16584 16600->16599 16601 7ff7e19643f4 _get_daylight 11 API calls 16600->16601 16601->16597 16638 7ff7e19733bc 16602->16638 16606 7ff7e196d6bc 16607 7ff7e196d6c0 16606->16607 16608 7ff7e196d711 16606->16608 16609 7ff7e196d6dc 16606->16609 16607->16568 16691 7ff7e196d200 16608->16691 16687 7ff7e196d4bc 16609->16687 16613 7ff7e19733bc 38 API calls 16612->16613 16614 7ff7e196d42e 16613->16614 16615 7ff7e1972e04 37 API calls 16614->16615 16616 7ff7e196d47e 16615->16616 16617 7ff7e196d482 16616->16617 16618 7ff7e196d4bc 45 API calls 16616->16618 16617->16568 16618->16617 16620 7ff7e19733bc 38 API calls 16619->16620 16621 7ff7e196d14f 16620->16621 16622 7ff7e1972e04 37 API calls 16621->16622 16623 7ff7e196d1a7 16622->16623 16624 7ff7e196d1ab 16623->16624 16625 7ff7e196d200 45 API calls 16623->16625 16624->16568 16625->16624 16627 7ff7e196cde4 16626->16627 16628 7ff7e196cdb1 16626->16628 16630 7ff7e196cdfc 16627->16630 16633 7ff7e196ce7d 16627->16633 16629 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16628->16629 16632 7ff7e196cddd memcpy_s 16629->16632 16631 7ff7e196d104 46 API calls 16630->16631 16631->16632 16632->16568 16633->16632 16634 7ff7e1963ae0 45 API calls 16633->16634 16634->16632 16636 7ff7e1969a88 _invalid_parameter_noinfo 37 API calls 16635->16636 16637 7ff7e1969c09 16636->16637 16637->16599 16639 7ff7e197340f fegetenv 16638->16639 16640 7ff7e197713c 37 API calls 16639->16640 16643 7ff7e1973462 16640->16643 16641 7ff7e197348f 16645 7ff7e19697b4 __std_exception_copy 37 API calls 16641->16645 16642 7ff7e1973552 16644 7ff7e197713c 37 API calls 16642->16644 16643->16642 16648 7ff7e197352c 16643->16648 16649 7ff7e197347d 16643->16649 16646 7ff7e197357c 16644->16646 16647 7ff7e197350d 16645->16647 16650 7ff7e197713c 37 API calls 16646->16650 16651 7ff7e1974634 16647->16651 16657 7ff7e1973515 16647->16657 16652 7ff7e19697b4 __std_exception_copy 37 API calls 16648->16652 16649->16641 16649->16642 16653 7ff7e197358d 16650->16653 16654 7ff7e1969c10 _isindst 17 API calls 16651->16654 16652->16647 16655 7ff7e1977330 20 API calls 16653->16655 16656 7ff7e1974649 16654->16656 16666 7ff7e19735f6 memcpy_s 16655->16666 16658 7ff7e195b870 _log10_special 8 API calls 16657->16658 16659 7ff7e196d661 16658->16659 16683 7ff7e1972e04 16659->16683 16660 7ff7e197399f memcpy_s 16661 7ff7e1973cdf 16662 7ff7e1972f20 37 API calls 16661->16662 16673 7ff7e19743f7 16662->16673 16663 7ff7e1973c8b 16663->16661 16667 7ff7e197464c memcpy_s 37 API calls 16663->16667 16664 7ff7e1974452 16669 7ff7e19745d8 16664->16669 16679 7ff7e1972f20 37 API calls 16664->16679 16682 7ff7e197464c memcpy_s 37 API calls 16664->16682 16665 7ff7e1973637 memcpy_s 16670 7ff7e1973a93 memcpy_s 16665->16670 16672 7ff7e1973f7b memcpy_s 16665->16672 16666->16660 16666->16665 16668 7ff7e19643f4 _get_daylight 11 API calls 16666->16668 16667->16661 16671 7ff7e1973a70 16668->16671 16677 7ff7e197713c 37 API calls 16669->16677 16670->16663 16678 7ff7e19643f4 11 API calls _get_daylight 16670->16678 16681 7ff7e1969bf0 37 API calls _invalid_parameter_noinfo 16670->16681 16674 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 16671->16674 16672->16661 16672->16663 16676 7ff7e19643f4 11 API calls _get_daylight 16672->16676 16680 7ff7e1969bf0 37 API calls _invalid_parameter_noinfo 16672->16680 16673->16664 16675 7ff7e197464c memcpy_s 37 API calls 16673->16675 16674->16665 16675->16664 16676->16672 16677->16657 16678->16670 16679->16664 16680->16672 16681->16670 16682->16664 16684 7ff7e1972e23 16683->16684 16685 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16684->16685 16686 7ff7e1972e4e memcpy_s 16684->16686 16685->16686 16686->16606 16688 7ff7e196d4e8 memcpy_s 16687->16688 16689 7ff7e1963ae0 45 API calls 16688->16689 16690 7ff7e196d5a2 memcpy_s 16688->16690 16689->16690 16690->16607 16692 7ff7e196d23b 16691->16692 16696 7ff7e196d288 memcpy_s 16691->16696 16693 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16692->16693 16694 7ff7e196d267 16693->16694 16694->16607 16695 7ff7e196d2f3 16697 7ff7e19697b4 __std_exception_copy 37 API calls 16695->16697 16696->16695 16698 7ff7e1963ae0 45 API calls 16696->16698 16701 7ff7e196d335 memcpy_s 16697->16701 16698->16695 16699 7ff7e1969c10 _isindst 17 API calls 16700 7ff7e196d3e0 16699->16700 16701->16699 16703 7ff7e195ff6e 16702->16703 16704 7ff7e195ff7f 16702->16704 16703->16519 16704->16703 16705 7ff7e196c90c _fread_nolock 12 API calls 16704->16705 16706 7ff7e195ffb0 16705->16706 16707 7ff7e195ffc4 16706->16707 16709 7ff7e1969c58 __free_lconv_num 11 API calls 16706->16709 16708 7ff7e1969c58 __free_lconv_num 11 API calls 16707->16708 16708->16703 16709->16707 16711 7ff7e1963a8e 16710->16711 16712 7ff7e1963a86 16710->16712 16711->16530 16713 7ff7e1963ae0 45 API calls 16712->16713 16713->16711 16715 7ff7e196cce1 16714->16715 16717 7ff7e1963b1f 16714->16717 16715->16717 16722 7ff7e1972614 16715->16722 16718 7ff7e196cd34 16717->16718 16719 7ff7e196cd4d 16718->16719 16720 7ff7e1963b2f 16718->16720 16719->16720 16757 7ff7e1971960 16719->16757 16720->16451 16734 7ff7e196a460 GetLastError 16722->16734 16725 7ff7e197266e 16725->16717 16735 7ff7e196a484 FlsGetValue 16734->16735 16736 7ff7e196a4a1 FlsSetValue 16734->16736 16737 7ff7e196a49b 16735->16737 16754 7ff7e196a491 16735->16754 16738 7ff7e196a4b3 16736->16738 16736->16754 16737->16736 16740 7ff7e196dea8 _get_daylight 11 API calls 16738->16740 16739 7ff7e196a50d SetLastError 16741 7ff7e196a52d 16739->16741 16742 7ff7e196a51a 16739->16742 16743 7ff7e196a4c2 16740->16743 16744 7ff7e1969814 __FrameHandler3::FrameUnwindToEmptyState 38 API calls 16741->16744 16742->16725 16756 7ff7e196f5e8 EnterCriticalSection 16742->16756 16745 7ff7e196a4e0 FlsSetValue 16743->16745 16746 7ff7e196a4d0 FlsSetValue 16743->16746 16749 7ff7e196a532 16744->16749 16747 7ff7e196a4fe 16745->16747 16748 7ff7e196a4ec FlsSetValue 16745->16748 16750 7ff7e196a4d9 16746->16750 16751 7ff7e196a204 _get_daylight 11 API calls 16747->16751 16748->16750 16752 7ff7e1969c58 __free_lconv_num 11 API calls 16750->16752 16753 7ff7e196a506 16751->16753 16752->16754 16755 7ff7e1969c58 __free_lconv_num 11 API calls 16753->16755 16754->16739 16755->16739 16758 7ff7e196a460 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16757->16758 16759 7ff7e1971969 16758->16759 16766 7ff7e1976098 16760->16766 16764 7ff7e196ebb9 MultiByteToWideChar 16763->16764 16769 7ff7e19760fc 16766->16769 16767 7ff7e195b870 _log10_special 8 API calls 16768 7ff7e196f3cd 16767->16768 16768->16545 16769->16767 16771 7ff7e196031d 16770->16771 16772 7ff7e196032f 16770->16772 16773 7ff7e19643f4 _get_daylight 11 API calls 16771->16773 16774 7ff7e196033d 16772->16774 16778 7ff7e1960379 16772->16778 16775 7ff7e1960322 16773->16775 16776 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16774->16776 16777 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 16775->16777 16782 7ff7e196032d 16776->16782 16777->16782 16779 7ff7e19606f5 16778->16779 16781 7ff7e19643f4 _get_daylight 11 API calls 16778->16781 16780 7ff7e19643f4 _get_daylight 11 API calls 16779->16780 16779->16782 16783 7ff7e1960989 16780->16783 16784 7ff7e19606ea 16781->16784 16782->16417 16786 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 16783->16786 16785 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 16784->16785 16785->16779 16786->16782 16788 7ff7e195fa24 16787->16788 16817 7ff7e195f784 16788->16817 16790 7ff7e195fa3d 16790->15974 16829 7ff7e195f6dc 16791->16829 16795 7ff7e195277c 16794->16795 16796 7ff7e19643f4 _get_daylight 11 API calls 16795->16796 16797 7ff7e1952799 16796->16797 16843 7ff7e1963ca4 16797->16843 16802 7ff7e1951bf0 49 API calls 16803 7ff7e1952807 16802->16803 16804 7ff7e19586b0 2 API calls 16803->16804 16805 7ff7e195281f 16804->16805 16806 7ff7e195282c MessageBoxW 16805->16806 16807 7ff7e1952843 MessageBoxA 16805->16807 16808 7ff7e1952855 16806->16808 16807->16808 16809 7ff7e195b870 _log10_special 8 API calls 16808->16809 16810 7ff7e1952865 16809->16810 16810->16003 16812 7ff7e1951b06 16811->16812 16813 7ff7e195f439 16811->16813 16812->16002 16812->16003 16814 7ff7e19643f4 _get_daylight 11 API calls 16813->16814 16815 7ff7e195f43e 16814->16815 16816 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 16815->16816 16816->16812 16818 7ff7e195f7ee 16817->16818 16819 7ff7e195f7ae 16817->16819 16818->16819 16820 7ff7e195f7fa 16818->16820 16821 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16819->16821 16828 7ff7e196477c EnterCriticalSection 16820->16828 16823 7ff7e195f7d5 16821->16823 16823->16790 16830 7ff7e195f706 16829->16830 16841 7ff7e19519b9 16829->16841 16831 7ff7e195f715 memcpy_s 16830->16831 16832 7ff7e195f752 16830->16832 16830->16841 16835 7ff7e19643f4 _get_daylight 11 API calls 16831->16835 16842 7ff7e196477c EnterCriticalSection 16832->16842 16837 7ff7e195f72a 16835->16837 16839 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 16837->16839 16839->16841 16841->15980 16841->15981 16845 7ff7e1963cfe 16843->16845 16844 7ff7e1963d23 16846 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16844->16846 16845->16844 16847 7ff7e1963d5f 16845->16847 16860 7ff7e1963d4d 16846->16860 16873 7ff7e1961f30 16847->16873 16850 7ff7e195b870 _log10_special 8 API calls 16852 7ff7e19527d8 16850->16852 16851 7ff7e1969c58 __free_lconv_num 11 API calls 16851->16860 16861 7ff7e1964480 16852->16861 16853 7ff7e1963e3c 16853->16851 16854 7ff7e1963e60 16854->16853 16856 7ff7e1963e6a 16854->16856 16855 7ff7e1963e11 16857 7ff7e1969c58 __free_lconv_num 11 API calls 16855->16857 16859 7ff7e1969c58 __free_lconv_num 11 API calls 16856->16859 16857->16860 16858 7ff7e1963e08 16858->16853 16858->16855 16859->16860 16860->16850 16862 7ff7e196a5d8 _get_daylight 11 API calls 16861->16862 16863 7ff7e1964497 16862->16863 16864 7ff7e19527df 16863->16864 16865 7ff7e196dea8 _get_daylight 11 API calls 16863->16865 16868 7ff7e19644d7 16863->16868 16864->16802 16866 7ff7e19644cc 16865->16866 16867 7ff7e1969c58 __free_lconv_num 11 API calls 16866->16867 16867->16868 16868->16864 17011 7ff7e196df30 16868->17011 16871 7ff7e1969c10 _isindst 17 API calls 16872 7ff7e196451c 16871->16872 16874 7ff7e1961f6e 16873->16874 16875 7ff7e1961f5e 16873->16875 16876 7ff7e1961f77 16874->16876 16880 7ff7e1961fa5 16874->16880 16877 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16875->16877 16878 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16876->16878 16879 7ff7e1961f9d 16877->16879 16878->16879 16879->16853 16879->16854 16879->16855 16879->16858 16880->16875 16880->16879 16881 7ff7e1963ae0 45 API calls 16880->16881 16883 7ff7e1962254 16880->16883 16887 7ff7e19628c0 16880->16887 16913 7ff7e1962588 16880->16913 16943 7ff7e1961e10 16880->16943 16881->16880 16885 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16883->16885 16885->16875 16888 7ff7e1962975 16887->16888 16889 7ff7e1962902 16887->16889 16892 7ff7e196297a 16888->16892 16898 7ff7e19629cf 16888->16898 16890 7ff7e1962908 16889->16890 16891 7ff7e196299f 16889->16891 16894 7ff7e196290d 16890->16894 16901 7ff7e19629de 16890->16901 16960 7ff7e1960e70 16891->16960 16895 7ff7e19629af 16892->16895 16897 7ff7e196297c 16892->16897 16896 7ff7e196291d 16894->16896 16902 7ff7e1962950 16894->16902 16911 7ff7e1962938 16894->16911 16967 7ff7e1960a60 16895->16967 16912 7ff7e1962a0d 16896->16912 16946 7ff7e1963224 16896->16946 16897->16896 16904 7ff7e196298b 16897->16904 16898->16891 16898->16901 16898->16911 16901->16912 16974 7ff7e1961280 16901->16974 16902->16912 16956 7ff7e19636e0 16902->16956 16904->16891 16906 7ff7e1962990 16904->16906 16908 7ff7e1963878 37 API calls 16906->16908 16906->16912 16907 7ff7e195b870 _log10_special 8 API calls 16909 7ff7e1962ca3 16907->16909 16908->16911 16909->16880 16911->16912 16981 7ff7e196db68 16911->16981 16912->16907 16914 7ff7e19625a9 16913->16914 16915 7ff7e1962593 16913->16915 16916 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16914->16916 16928 7ff7e19625e7 16914->16928 16917 7ff7e1962975 16915->16917 16918 7ff7e1962902 16915->16918 16915->16928 16916->16928 16921 7ff7e196297a 16917->16921 16927 7ff7e19629cf 16917->16927 16919 7ff7e1962908 16918->16919 16920 7ff7e196299f 16918->16920 16923 7ff7e196290d 16919->16923 16931 7ff7e19629de 16919->16931 16922 7ff7e1960e70 38 API calls 16920->16922 16924 7ff7e19629af 16921->16924 16926 7ff7e196297c 16921->16926 16941 7ff7e1962938 16922->16941 16925 7ff7e196291d 16923->16925 16932 7ff7e1962950 16923->16932 16923->16941 16929 7ff7e1960a60 38 API calls 16924->16929 16930 7ff7e1963224 47 API calls 16925->16930 16942 7ff7e1962a0d 16925->16942 16926->16925 16934 7ff7e196298b 16926->16934 16927->16920 16927->16931 16927->16941 16928->16880 16929->16941 16930->16941 16933 7ff7e1961280 38 API calls 16931->16933 16931->16942 16935 7ff7e19636e0 47 API calls 16932->16935 16932->16942 16933->16941 16934->16920 16936 7ff7e1962990 16934->16936 16935->16941 16938 7ff7e1963878 37 API calls 16936->16938 16936->16942 16937 7ff7e195b870 _log10_special 8 API calls 16939 7ff7e1962ca3 16937->16939 16938->16941 16939->16880 16940 7ff7e196db68 47 API calls 16940->16941 16941->16940 16941->16942 16942->16937 16994 7ff7e1960034 16943->16994 16947 7ff7e1963246 16946->16947 16948 7ff7e195fea0 12 API calls 16947->16948 16949 7ff7e196328e 16948->16949 16950 7ff7e196d880 46 API calls 16949->16950 16951 7ff7e1963361 16950->16951 16952 7ff7e1963383 16951->16952 16953 7ff7e1963ae0 45 API calls 16951->16953 16954 7ff7e196340c 16952->16954 16955 7ff7e1963ae0 45 API calls 16952->16955 16953->16952 16954->16911 16955->16954 16957 7ff7e19636f8 16956->16957 16959 7ff7e1963760 16956->16959 16958 7ff7e196db68 47 API calls 16957->16958 16957->16959 16958->16959 16959->16911 16961 7ff7e1960ea3 16960->16961 16962 7ff7e1960ed2 16961->16962 16964 7ff7e1960f8f 16961->16964 16963 7ff7e195fea0 12 API calls 16962->16963 16966 7ff7e1960f0f 16962->16966 16963->16966 16965 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16964->16965 16965->16966 16966->16911 16968 7ff7e1960a93 16967->16968 16969 7ff7e1960ac2 16968->16969 16971 7ff7e1960b7f 16968->16971 16970 7ff7e195fea0 12 API calls 16969->16970 16973 7ff7e1960aff 16969->16973 16970->16973 16972 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16971->16972 16972->16973 16973->16911 16976 7ff7e19612b3 16974->16976 16975 7ff7e19612e2 16977 7ff7e195fea0 12 API calls 16975->16977 16980 7ff7e196131f 16975->16980 16976->16975 16978 7ff7e196139f 16976->16978 16977->16980 16979 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16978->16979 16979->16980 16980->16911 16982 7ff7e196db90 16981->16982 16983 7ff7e196dbd5 16982->16983 16984 7ff7e1963ae0 45 API calls 16982->16984 16986 7ff7e196dbbe memcpy_s 16982->16986 16989 7ff7e196db95 memcpy_s 16982->16989 16983->16986 16983->16989 16991 7ff7e196faf8 16983->16991 16984->16983 16985 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16985->16989 16986->16985 16986->16989 16989->16911 16993 7ff7e196fb1c WideCharToMultiByte 16991->16993 16995 7ff7e1960073 16994->16995 16996 7ff7e1960061 16994->16996 16999 7ff7e1960080 16995->16999 17002 7ff7e19600bd 16995->17002 16997 7ff7e19643f4 _get_daylight 11 API calls 16996->16997 16998 7ff7e1960066 16997->16998 17000 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 16998->17000 17001 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 16999->17001 17007 7ff7e1960071 17000->17007 17001->17007 17003 7ff7e1960166 17002->17003 17005 7ff7e19643f4 _get_daylight 11 API calls 17002->17005 17004 7ff7e19643f4 _get_daylight 11 API calls 17003->17004 17003->17007 17006 7ff7e1960210 17004->17006 17008 7ff7e196015b 17005->17008 17009 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 17006->17009 17007->16880 17010 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 17008->17010 17009->17007 17010->17003 17015 7ff7e196df4d 17011->17015 17012 7ff7e196df52 17013 7ff7e19644fd 17012->17013 17014 7ff7e19643f4 _get_daylight 11 API calls 17012->17014 17013->16864 17013->16871 17016 7ff7e196df5c 17014->17016 17015->17012 17015->17013 17018 7ff7e196df9c 17015->17018 17017 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 17016->17017 17017->17013 17018->17013 17019 7ff7e19643f4 _get_daylight 11 API calls 17018->17019 17019->17016 17021 7ff7e1967568 17020->17021 17022 7ff7e1967555 17020->17022 17030 7ff7e19671cc 17021->17030 17023 7ff7e19643f4 _get_daylight 11 API calls 17022->17023 17025 7ff7e196755a 17023->17025 17027 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 17025->17027 17029 7ff7e1967566 17027->17029 17029->16021 17037 7ff7e196f5e8 EnterCriticalSection 17030->17037 17039 7ff7e1957b91 GetTokenInformation 17038->17039 17041 7ff7e1957c13 __std_exception_destroy 17038->17041 17040 7ff7e1957bb2 GetLastError 17039->17040 17042 7ff7e1957bbd 17039->17042 17040->17041 17040->17042 17043 7ff7e1957c2c 17041->17043 17044 7ff7e1957c26 CloseHandle 17041->17044 17042->17041 17045 7ff7e1957bd9 GetTokenInformation 17042->17045 17043->16030 17044->17043 17045->17041 17046 7ff7e1957bfc 17045->17046 17046->17041 17047 7ff7e1957c06 ConvertSidToStringSidW 17046->17047 17047->17041 17049 7ff7e195297a 17048->17049 17333 7ff7e1953f70 108 API calls 17332->17333 17334 7ff7e1951463 17333->17334 17335 7ff7e195146b 17334->17335 17336 7ff7e195148c 17334->17336 17337 7ff7e19525f0 53 API calls 17335->17337 17338 7ff7e195f9f4 73 API calls 17336->17338 17339 7ff7e195147b 17337->17339 17340 7ff7e19514a1 17338->17340 17339->16090 17341 7ff7e19514a5 17340->17341 17342 7ff7e19514c1 17340->17342 17343 7ff7e1952760 53 API calls 17341->17343 17344 7ff7e19514f1 17342->17344 17345 7ff7e19514d1 17342->17345 17351 7ff7e19514bc __std_exception_destroy 17343->17351 17347 7ff7e19514f7 17344->17347 17353 7ff7e195150a 17344->17353 17346 7ff7e1952760 53 API calls 17345->17346 17346->17351 17356 7ff7e19511f0 17347->17356 17348 7ff7e195f36c 74 API calls 17350 7ff7e1951584 17348->17350 17350->16090 17351->17348 17352 7ff7e195f6bc _fread_nolock 53 API calls 17352->17353 17353->17351 17353->17352 17354 7ff7e1951596 17353->17354 17355 7ff7e1952760 53 API calls 17354->17355 17355->17351 17357 7ff7e1951248 17356->17357 17358 7ff7e1951277 17357->17358 17359 7ff7e195124f 17357->17359 17362 7ff7e19512ad 17358->17362 17363 7ff7e1951291 17358->17363 17360 7ff7e19525f0 53 API calls 17359->17360 17361 7ff7e1951262 17360->17361 17361->17351 17365 7ff7e19512bf 17362->17365 17372 7ff7e19512db memcpy_s 17362->17372 17364 7ff7e1952760 53 API calls 17363->17364 17368 7ff7e19512a8 __std_exception_destroy 17364->17368 17366 7ff7e1952760 53 API calls 17365->17366 17366->17368 17367 7ff7e195f6bc _fread_nolock 53 API calls 17367->17372 17368->17351 17369 7ff7e195139f 17372->17367 17372->17368 17372->17369 17373 7ff7e195f430 37 API calls 17372->17373 17374 7ff7e195fdfc 17372->17374 17373->17372 17394 7ff7e1953f1a 17393->17394 17395 7ff7e19586b0 2 API calls 17394->17395 17396 7ff7e1953f3f 17395->17396 17397 7ff7e195b870 _log10_special 8 API calls 17396->17397 17398 7ff7e1953f67 17397->17398 17398->16113 17400 7ff7e195753e 17399->17400 17401 7ff7e1951bf0 49 API calls 17400->17401 17404 7ff7e1957662 17400->17404 17407 7ff7e19575c5 17401->17407 17402 7ff7e195b870 _log10_special 8 API calls 17403 7ff7e1957693 17402->17403 17403->16113 17404->17402 17405 7ff7e1951bf0 49 API calls 17405->17407 17406 7ff7e1953f10 10 API calls 17406->17407 17407->17404 17407->17405 17407->17406 17408 7ff7e19586b0 2 API calls 17407->17408 17409 7ff7e1957633 CreateDirectoryW 17408->17409 17409->17404 17409->17407 17411 7ff7e19515f7 17410->17411 17412 7ff7e19515d3 17410->17412 17413 7ff7e1953f70 108 API calls 17411->17413 17499 7ff7e1951050 17412->17499 17415 7ff7e195160b 17413->17415 17418 7ff7e195163b 17415->17418 17419 7ff7e1951613 17415->17419 17416 7ff7e19515d8 17417 7ff7e19515ee 17416->17417 17420 7ff7e19525f0 53 API calls 17416->17420 17417->16113 17422 7ff7e1953f70 108 API calls 17418->17422 17421 7ff7e1952760 53 API calls 17419->17421 17420->17417 17423 7ff7e195162a 17421->17423 17424 7ff7e195164f 17422->17424 17423->16113 17425 7ff7e1951657 17424->17425 17426 7ff7e1951671 17424->17426 17428 7ff7e19525f0 53 API calls 17425->17428 17427 7ff7e195f9f4 73 API calls 17426->17427 17429 7ff7e1951686 17427->17429 17430 7ff7e1951667 17428->17430 17449 7ff7e195694b 17448->17449 17451 7ff7e1956904 17448->17451 17449->16113 17451->17449 17538 7ff7e1964250 17451->17538 17453 7ff7e1953b51 17452->17453 17454 7ff7e1953e90 49 API calls 17453->17454 17455 7ff7e1953b8b 17454->17455 17456 7ff7e1953e90 49 API calls 17455->17456 17457 7ff7e1953b9b 17456->17457 17458 7ff7e1953bec 17457->17458 17459 7ff7e1953bbd 17457->17459 17461 7ff7e1953ac0 51 API calls 17458->17461 17569 7ff7e1953ac0 17459->17569 17462 7ff7e1953bea 17461->17462 17497 7ff7e1951bf0 49 API calls 17496->17497 17498 7ff7e1953e24 17497->17498 17498->16113 17500 7ff7e1953f70 108 API calls 17499->17500 17501 7ff7e195108b 17500->17501 17502 7ff7e19510a8 17501->17502 17503 7ff7e1951093 17501->17503 17505 7ff7e195f9f4 73 API calls 17502->17505 17504 7ff7e19525f0 53 API calls 17503->17504 17510 7ff7e19510a3 __std_exception_destroy 17504->17510 17506 7ff7e19510bd 17505->17506 17507 7ff7e19510dd 17506->17507 17508 7ff7e19510c1 17506->17508 17510->17416 17539 7ff7e196425d 17538->17539 17540 7ff7e196428a 17538->17540 17541 7ff7e19643f4 _get_daylight 11 API calls 17539->17541 17545 7ff7e1964214 17539->17545 17542 7ff7e19642ad 17540->17542 17543 7ff7e19642c9 17540->17543 17544 7ff7e1964267 17541->17544 17546 7ff7e19643f4 _get_daylight 11 API calls 17542->17546 17553 7ff7e1964178 17543->17553 17548 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 17544->17548 17545->17451 17549 7ff7e19642b2 17546->17549 17550 7ff7e1964272 17548->17550 17551 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 17549->17551 17550->17451 17552 7ff7e19642bd 17551->17552 17552->17451 17554 7ff7e196419c 17553->17554 17555 7ff7e1964197 17553->17555 17554->17555 17556 7ff7e196a460 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17554->17556 17555->17552 17557 7ff7e19641b7 17556->17557 17561 7ff7e196cc94 17557->17561 17570 7ff7e1953ae6 17569->17570 17633 7ff7e195be12 RtlLookupFunctionEntry 17632->17633 17634 7ff7e195be28 RtlVirtualUnwind 17633->17634 17635 7ff7e195bc2b 17633->17635 17634->17633 17634->17635 17636 7ff7e195bbc0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 17635->17636 17638 7ff7e19651d8 17637->17638 17639 7ff7e19651fe 17638->17639 17642 7ff7e1965231 17638->17642 17640 7ff7e19643f4 _get_daylight 11 API calls 17639->17640 17641 7ff7e1965203 17640->17641 17643 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 17641->17643 17644 7ff7e1965237 17642->17644 17645 7ff7e1965244 17642->17645 17649 7ff7e1953fc6 17643->17649 17646 7ff7e19643f4 _get_daylight 11 API calls 17644->17646 17656 7ff7e1969f38 17645->17656 17646->17649 17649->16150 17669 7ff7e196f5e8 EnterCriticalSection 17656->17669 18029 7ff7e1966c08 18028->18029 18032 7ff7e19666e4 18029->18032 18031 7ff7e1966c21 18031->16160 18033 7ff7e196672e 18032->18033 18034 7ff7e19666ff 18032->18034 18042 7ff7e196477c EnterCriticalSection 18033->18042 18035 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 18034->18035 18037 7ff7e196671f 18035->18037 18037->18031 18044 7ff7e195f163 18043->18044 18045 7ff7e195f191 18043->18045 18046 7ff7e1969b24 _invalid_parameter_noinfo 37 API calls 18044->18046 18049 7ff7e195f183 18045->18049 18053 7ff7e196477c EnterCriticalSection 18045->18053 18046->18049 18049->16164 18055 7ff7e19586b0 2 API calls 18054->18055 18056 7ff7e19581b4 LoadLibraryExW 18055->18056 18057 7ff7e19581d3 __std_exception_destroy 18056->18057 18057->16194 18059 7ff7e1956ec9 18058->18059 18060 7ff7e1956ef3 GetProcAddress 18058->18060 18062 7ff7e19529e0 51 API calls 18059->18062 18060->18059 18061 7ff7e1956f18 GetProcAddress 18060->18061 18061->18059 18063 7ff7e1956f3d GetProcAddress 18061->18063 18064 7ff7e1956ee3 18062->18064 18063->18059 18064->16201 18124 7ff7e1955b05 18123->18124 18125 7ff7e1951bf0 49 API calls 18124->18125 18126 7ff7e1955b41 18125->18126 18127 7ff7e1955b6d 18126->18127 18128 7ff7e1955b4a 18126->18128 18130 7ff7e1953fe0 49 API calls 18127->18130 18129 7ff7e19525f0 53 API calls 18128->18129 18146 7ff7e1955b63 18129->18146 18131 7ff7e1955b85 18130->18131 18132 7ff7e1955ba3 18131->18132 18134 7ff7e19525f0 53 API calls 18131->18134 18135 7ff7e1953f10 10 API calls 18132->18135 18133 7ff7e195b870 _log10_special 8 API calls 18136 7ff7e195308e 18133->18136 18134->18132 18137 7ff7e1955bad 18135->18137 18136->16234 18154 7ff7e1955c80 18136->18154 18138 7ff7e1955bbb 18137->18138 18140 7ff7e19581a0 3 API calls 18137->18140 18139 7ff7e1953fe0 49 API calls 18138->18139 18141 7ff7e1955bd4 18139->18141 18140->18138 18142 7ff7e1955bf9 18141->18142 18143 7ff7e1955bd9 18141->18143 18145 7ff7e19581a0 3 API calls 18142->18145 18144 7ff7e19525f0 53 API calls 18143->18144 18144->18146 18147 7ff7e1955c06 18145->18147 18146->18133 18293 7ff7e1954c80 18154->18293 18156 7ff7e1955cba 18157 7ff7e1955cd3 18156->18157 18158 7ff7e1955cc2 18156->18158 18300 7ff7e1954450 18157->18300 18159 7ff7e19525f0 53 API calls 18158->18159 18295 7ff7e1954cac 18293->18295 18294 7ff7e1954cb4 18294->18156 18295->18294 18298 7ff7e1954e54 18295->18298 18331 7ff7e1965db4 18295->18331 18296 7ff7e1955017 __std_exception_destroy 18296->18156 18297 7ff7e1954180 47 API calls 18297->18298 18298->18296 18298->18297 18332 7ff7e1965de4 18331->18332 18335 7ff7e19652b0 18332->18335 18336 7ff7e19652f3 18335->18336 18337 7ff7e19652e1 18335->18337 18339 7ff7e196533d 18336->18339 18341 7ff7e1965300 18336->18341 18411->16237 18413 7ff7e196a460 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18412->18413 18414 7ff7e19696f1 18413->18414 18417 7ff7e1969814 18414->18417 18426 7ff7e1972960 18417->18426 18452 7ff7e1972918 18426->18452 18457 7ff7e196f5e8 EnterCriticalSection 18452->18457 18681 7ff7e196fbd8 18682 7ff7e196fbfc 18681->18682 18685 7ff7e196fc0c 18681->18685 18683 7ff7e19643f4 _get_daylight 11 API calls 18682->18683 18703 7ff7e196fc01 18683->18703 18684 7ff7e196feec 18687 7ff7e19643f4 _get_daylight 11 API calls 18684->18687 18685->18684 18686 7ff7e196fc2e 18685->18686 18688 7ff7e196fc4f 18686->18688 18812 7ff7e1970294 18686->18812 18689 7ff7e196fef1 18687->18689 18692 7ff7e196fcc1 18688->18692 18694 7ff7e196fc75 18688->18694 18699 7ff7e196fcb5 18688->18699 18691 7ff7e1969c58 __free_lconv_num 11 API calls 18689->18691 18691->18703 18696 7ff7e196dea8 _get_daylight 11 API calls 18692->18696 18713 7ff7e196fc84 18692->18713 18693 7ff7e196fd6e 18702 7ff7e196fd8b 18693->18702 18710 7ff7e196fddd 18693->18710 18827 7ff7e19689d8 18694->18827 18700 7ff7e196fcd7 18696->18700 18698 7ff7e1969c58 __free_lconv_num 11 API calls 18698->18703 18699->18693 18699->18713 18833 7ff7e197643c 18699->18833 18704 7ff7e1969c58 __free_lconv_num 11 API calls 18700->18704 18707 7ff7e1969c58 __free_lconv_num 11 API calls 18702->18707 18708 7ff7e196fce5 18704->18708 18705 7ff7e196fc9d 18705->18699 18712 7ff7e1970294 45 API calls 18705->18712 18706 7ff7e196fc7f 18709 7ff7e19643f4 _get_daylight 11 API calls 18706->18709 18711 7ff7e196fd94 18707->18711 18708->18699 18708->18713 18716 7ff7e196dea8 _get_daylight 11 API calls 18708->18716 18709->18713 18710->18713 18714 7ff7e19726ec 40 API calls 18710->18714 18722 7ff7e196fd99 18711->18722 18869 7ff7e19726ec 18711->18869 18712->18699 18713->18698 18715 7ff7e196fe1a 18714->18715 18718 7ff7e1969c58 __free_lconv_num 11 API calls 18715->18718 18717 7ff7e196fd07 18716->18717 18720 7ff7e1969c58 __free_lconv_num 11 API calls 18717->18720 18721 7ff7e196fe24 18718->18721 18720->18699 18721->18713 18721->18722 18723 7ff7e196fee0 18722->18723 18727 7ff7e196dea8 _get_daylight 11 API calls 18722->18727 18725 7ff7e1969c58 __free_lconv_num 11 API calls 18723->18725 18724 7ff7e196fdc5 18726 7ff7e1969c58 __free_lconv_num 11 API calls 18724->18726 18725->18703 18726->18722 18728 7ff7e196fe68 18727->18728 18729 7ff7e196fe79 18728->18729 18730 7ff7e196fe70 18728->18730 18731 7ff7e19697b4 __std_exception_copy 37 API calls 18729->18731 18732 7ff7e1969c58 __free_lconv_num 11 API calls 18730->18732 18734 7ff7e196fe88 18731->18734 18733 7ff7e196fe77 18732->18733 18739 7ff7e1969c58 __free_lconv_num 11 API calls 18733->18739 18735 7ff7e196ff1b 18734->18735 18736 7ff7e196fe90 18734->18736 18738 7ff7e1969c10 _isindst 17 API calls 18735->18738 18878 7ff7e1976554 18736->18878 18741 7ff7e196ff2f 18738->18741 18739->18703 18744 7ff7e196ff58 18741->18744 18751 7ff7e196ff68 18741->18751 18742 7ff7e196feb7 18746 7ff7e19643f4 _get_daylight 11 API calls 18742->18746 18743 7ff7e196fed8 18745 7ff7e1969c58 __free_lconv_num 11 API calls 18743->18745 18747 7ff7e19643f4 _get_daylight 11 API calls 18744->18747 18745->18723 18748 7ff7e196febc 18746->18748 18749 7ff7e196ff5d 18747->18749 18752 7ff7e1969c58 __free_lconv_num 11 API calls 18748->18752 18750 7ff7e197024b 18754 7ff7e19643f4 _get_daylight 11 API calls 18750->18754 18751->18750 18753 7ff7e196ff8a 18751->18753 18752->18733 18759 7ff7e196ffa7 18753->18759 18897 7ff7e197037c 18753->18897 18755 7ff7e1970250 18754->18755 18757 7ff7e1969c58 __free_lconv_num 11 API calls 18755->18757 18757->18749 18758 7ff7e197001b 18763 7ff7e1970043 18758->18763 18767 7ff7e196dea8 _get_daylight 11 API calls 18758->18767 18779 7ff7e196ffde 18758->18779 18759->18758 18761 7ff7e196ffcf 18759->18761 18771 7ff7e197000f 18759->18771 18760 7ff7e19700ce 18769 7ff7e19700eb 18760->18769 18780 7ff7e197013e 18760->18780 18912 7ff7e1968a14 18761->18912 18765 7ff7e196dea8 _get_daylight 11 API calls 18763->18765 18763->18771 18763->18779 18770 7ff7e1970065 18765->18770 18766 7ff7e1969c58 __free_lconv_num 11 API calls 18766->18749 18772 7ff7e1970035 18767->18772 18775 7ff7e1969c58 __free_lconv_num 11 API calls 18769->18775 18776 7ff7e1969c58 __free_lconv_num 11 API calls 18770->18776 18771->18760 18771->18779 18918 7ff7e19762fc 18771->18918 18777 7ff7e1969c58 __free_lconv_num 11 API calls 18772->18777 18773 7ff7e196ffd9 18778 7ff7e19643f4 _get_daylight 11 API calls 18773->18778 18774 7ff7e196fff7 18774->18771 18782 7ff7e197037c 45 API calls 18774->18782 18781 7ff7e19700f4 18775->18781 18776->18771 18777->18763 18778->18779 18779->18766 18780->18779 18783 7ff7e19726ec 40 API calls 18780->18783 18786 7ff7e19726ec 40 API calls 18781->18786 18788 7ff7e19700fa 18781->18788 18782->18771 18784 7ff7e197017c 18783->18784 18785 7ff7e1969c58 __free_lconv_num 11 API calls 18784->18785 18787 7ff7e1970186 18785->18787 18790 7ff7e1970126 18786->18790 18787->18779 18787->18788 18789 7ff7e197023f 18788->18789 18793 7ff7e196dea8 _get_daylight 11 API calls 18788->18793 18791 7ff7e1969c58 __free_lconv_num 11 API calls 18789->18791 18792 7ff7e1969c58 __free_lconv_num 11 API calls 18790->18792 18791->18749 18792->18788 18794 7ff7e19701cb 18793->18794 18795 7ff7e19701dc 18794->18795 18796 7ff7e19701d3 18794->18796 18798 7ff7e196f784 37 API calls 18795->18798 18797 7ff7e1969c58 __free_lconv_num 11 API calls 18796->18797 18799 7ff7e19701da 18797->18799 18800 7ff7e19701ea 18798->18800 18806 7ff7e1969c58 __free_lconv_num 11 API calls 18799->18806 18801 7ff7e19701f2 SetEnvironmentVariableW 18800->18801 18802 7ff7e197027f 18800->18802 18803 7ff7e1970237 18801->18803 18804 7ff7e1970216 18801->18804 18805 7ff7e1969c10 _isindst 17 API calls 18802->18805 18807 7ff7e1969c58 __free_lconv_num 11 API calls 18803->18807 18808 7ff7e19643f4 _get_daylight 11 API calls 18804->18808 18809 7ff7e1970293 18805->18809 18806->18749 18807->18789 18810 7ff7e197021b 18808->18810 18811 7ff7e1969c58 __free_lconv_num 11 API calls 18810->18811 18811->18799 18813 7ff7e19702c9 18812->18813 18820 7ff7e19702b1 18812->18820 18813->18813 18814 7ff7e196dea8 _get_daylight 11 API calls 18813->18814 18822 7ff7e19702ed 18814->18822 18815 7ff7e1970372 18817 7ff7e1969814 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18815->18817 18816 7ff7e197034e 18819 7ff7e1969c58 __free_lconv_num 11 API calls 18816->18819 18818 7ff7e1970378 18817->18818 18819->18820 18820->18688 18821 7ff7e196dea8 _get_daylight 11 API calls 18821->18822 18822->18815 18822->18816 18822->18821 18823 7ff7e1969c58 __free_lconv_num 11 API calls 18822->18823 18824 7ff7e19697b4 __std_exception_copy 37 API calls 18822->18824 18825 7ff7e197035d 18822->18825 18823->18822 18824->18822 18826 7ff7e1969c10 _isindst 17 API calls 18825->18826 18826->18815 18828 7ff7e19689e8 18827->18828 18831 7ff7e19689f1 18827->18831 18828->18831 18942 7ff7e19684b0 18828->18942 18831->18705 18831->18706 18834 7ff7e1976449 18833->18834 18835 7ff7e1975564 18833->18835 18837 7ff7e1964178 45 API calls 18834->18837 18836 7ff7e1975571 18835->18836 18843 7ff7e19755a7 18835->18843 18840 7ff7e19643f4 _get_daylight 11 API calls 18836->18840 18853 7ff7e1975518 18836->18853 18838 7ff7e197647d 18837->18838 18844 7ff7e1976493 18838->18844 18848 7ff7e19764aa 18838->18848 18868 7ff7e1976482 18838->18868 18839 7ff7e19755d1 18841 7ff7e19643f4 _get_daylight 11 API calls 18839->18841 18842 7ff7e197557b 18840->18842 18845 7ff7e19755d6 18841->18845 18846 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18842->18846 18843->18839 18847 7ff7e19755f6 18843->18847 18849 7ff7e19643f4 _get_daylight 11 API calls 18844->18849 18850 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18845->18850 18851 7ff7e1975586 18846->18851 18852 7ff7e1964178 45 API calls 18847->18852 18857 7ff7e19755e1 18847->18857 18855 7ff7e19764c6 18848->18855 18856 7ff7e19764b4 18848->18856 18854 7ff7e1976498 18849->18854 18850->18857 18851->18699 18852->18857 18853->18699 18860 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18854->18860 18858 7ff7e19764ee 18855->18858 18859 7ff7e19764d7 18855->18859 18861 7ff7e19643f4 _get_daylight 11 API calls 18856->18861 18857->18699 19174 7ff7e197825c 18858->19174 19165 7ff7e19755b4 18859->19165 18860->18868 18862 7ff7e19764b9 18861->18862 18865 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18862->18865 18865->18868 18867 7ff7e19643f4 _get_daylight 11 API calls 18867->18868 18868->18699 18870 7ff7e197270e 18869->18870 18871 7ff7e197272b 18869->18871 18870->18871 18872 7ff7e197271c 18870->18872 18875 7ff7e1972735 18871->18875 19214 7ff7e1976f48 18871->19214 18873 7ff7e19643f4 _get_daylight 11 API calls 18872->18873 18877 7ff7e1972721 memcpy_s 18873->18877 19221 7ff7e1976f84 18875->19221 18877->18724 18879 7ff7e1964178 45 API calls 18878->18879 18880 7ff7e19765ba 18879->18880 18882 7ff7e19765c8 18880->18882 19233 7ff7e196e234 18880->19233 19236 7ff7e19647bc 18882->19236 18885 7ff7e1964178 45 API calls 18888 7ff7e1976637 18885->18888 18886 7ff7e19766b4 18887 7ff7e19766c5 18886->18887 18889 7ff7e1969c58 __free_lconv_num 11 API calls 18886->18889 18890 7ff7e196feb3 18887->18890 18892 7ff7e1969c58 __free_lconv_num 11 API calls 18887->18892 18891 7ff7e196e234 5 API calls 18888->18891 18893 7ff7e1976640 18888->18893 18889->18887 18890->18742 18890->18743 18891->18893 18892->18890 18894 7ff7e19647bc 14 API calls 18893->18894 18895 7ff7e197669b 18894->18895 18895->18886 18896 7ff7e19766a3 SetEnvironmentVariableW 18895->18896 18896->18886 18898 7ff7e19703bc 18897->18898 18899 7ff7e197039f 18897->18899 18900 7ff7e196dea8 _get_daylight 11 API calls 18898->18900 18899->18759 18906 7ff7e19703e0 18900->18906 18901 7ff7e1970441 18904 7ff7e1969c58 __free_lconv_num 11 API calls 18901->18904 18902 7ff7e1969814 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18903 7ff7e197046a 18902->18903 18904->18899 18905 7ff7e196dea8 _get_daylight 11 API calls 18905->18906 18906->18901 18906->18905 18907 7ff7e1969c58 __free_lconv_num 11 API calls 18906->18907 18908 7ff7e196f784 37 API calls 18906->18908 18909 7ff7e1970450 18906->18909 18911 7ff7e1970464 18906->18911 18907->18906 18908->18906 18910 7ff7e1969c10 _isindst 17 API calls 18909->18910 18910->18911 18911->18902 18913 7ff7e1968a24 18912->18913 18914 7ff7e1968a2d 18912->18914 18913->18914 19258 7ff7e1968524 18913->19258 18914->18773 18914->18774 18919 7ff7e1976309 18918->18919 18923 7ff7e1976336 18918->18923 18920 7ff7e197630e 18919->18920 18919->18923 18921 7ff7e19643f4 _get_daylight 11 API calls 18920->18921 18924 7ff7e1976313 18921->18924 18922 7ff7e197637a 18925 7ff7e19643f4 _get_daylight 11 API calls 18922->18925 18923->18922 18926 7ff7e1976399 18923->18926 18940 7ff7e197636e __crtLCMapStringW 18923->18940 18927 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18924->18927 18928 7ff7e197637f 18925->18928 18929 7ff7e19763b5 18926->18929 18930 7ff7e19763a3 18926->18930 18931 7ff7e197631e 18927->18931 18933 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18928->18933 18932 7ff7e1964178 45 API calls 18929->18932 18934 7ff7e19643f4 _get_daylight 11 API calls 18930->18934 18931->18771 18935 7ff7e19763c2 18932->18935 18933->18940 18936 7ff7e19763a8 18934->18936 18935->18940 19305 7ff7e1977e18 18935->19305 18937 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 18936->18937 18937->18940 18940->18771 18941 7ff7e19643f4 _get_daylight 11 API calls 18941->18940 18943 7ff7e19684c9 18942->18943 18944 7ff7e19684c5 18942->18944 18965 7ff7e1971900 18943->18965 18944->18831 18957 7ff7e1968804 18944->18957 18949 7ff7e19684db 18951 7ff7e1969c58 __free_lconv_num 11 API calls 18949->18951 18950 7ff7e19684e7 18991 7ff7e1968594 18950->18991 18951->18944 18954 7ff7e1969c58 __free_lconv_num 11 API calls 18955 7ff7e196850e 18954->18955 18956 7ff7e1969c58 __free_lconv_num 11 API calls 18955->18956 18956->18944 18958 7ff7e196882d 18957->18958 18963 7ff7e1968846 18957->18963 18958->18831 18959 7ff7e196faf8 WideCharToMultiByte 18959->18963 18960 7ff7e196dea8 _get_daylight 11 API calls 18960->18963 18961 7ff7e19688d6 18962 7ff7e1969c58 __free_lconv_num 11 API calls 18961->18962 18962->18958 18963->18958 18963->18959 18963->18960 18963->18961 18964 7ff7e1969c58 __free_lconv_num 11 API calls 18963->18964 18964->18963 18966 7ff7e197190d 18965->18966 18967 7ff7e19684ce 18965->18967 19010 7ff7e196a534 18966->19010 18971 7ff7e1971c3c GetEnvironmentStringsW 18967->18971 18972 7ff7e1971c6c 18971->18972 18973 7ff7e19684d3 18971->18973 18974 7ff7e196faf8 WideCharToMultiByte 18972->18974 18973->18949 18973->18950 18975 7ff7e1971cbd 18974->18975 18976 7ff7e1971cc4 FreeEnvironmentStringsW 18975->18976 18977 7ff7e196c90c _fread_nolock 12 API calls 18975->18977 18976->18973 18978 7ff7e1971cd7 18977->18978 18979 7ff7e1971ce8 18978->18979 18980 7ff7e1971cdf 18978->18980 18982 7ff7e196faf8 WideCharToMultiByte 18979->18982 18981 7ff7e1969c58 __free_lconv_num 11 API calls 18980->18981 18983 7ff7e1971ce6 18981->18983 18984 7ff7e1971d0b 18982->18984 18983->18976 18985 7ff7e1971d19 18984->18985 18986 7ff7e1971d0f 18984->18986 18988 7ff7e1969c58 __free_lconv_num 11 API calls 18985->18988 18987 7ff7e1969c58 __free_lconv_num 11 API calls 18986->18987 18989 7ff7e1971d17 FreeEnvironmentStringsW 18987->18989 18988->18989 18989->18973 18992 7ff7e19685b9 18991->18992 18993 7ff7e196dea8 _get_daylight 11 API calls 18992->18993 19004 7ff7e19685ef 18993->19004 18994 7ff7e19685f7 18995 7ff7e1969c58 __free_lconv_num 11 API calls 18994->18995 18996 7ff7e19684ef 18995->18996 18996->18954 18997 7ff7e196866a 18998 7ff7e1969c58 __free_lconv_num 11 API calls 18997->18998 18998->18996 18999 7ff7e196dea8 _get_daylight 11 API calls 18999->19004 19000 7ff7e1968659 19159 7ff7e19687c0 19000->19159 19002 7ff7e19697b4 __std_exception_copy 37 API calls 19002->19004 19004->18994 19004->18997 19004->18999 19004->19000 19004->19002 19005 7ff7e196868f 19004->19005 19007 7ff7e1969c58 __free_lconv_num 11 API calls 19004->19007 19008 7ff7e1969c10 _isindst 17 API calls 19005->19008 19006 7ff7e1969c58 __free_lconv_num 11 API calls 19006->18994 19007->19004 19009 7ff7e19686a2 19008->19009 19011 7ff7e196a545 FlsGetValue 19010->19011 19012 7ff7e196a560 FlsSetValue 19010->19012 19014 7ff7e196a552 19011->19014 19015 7ff7e196a55a 19011->19015 19013 7ff7e196a56d 19012->19013 19012->19014 19018 7ff7e196dea8 _get_daylight 11 API calls 19013->19018 19016 7ff7e196a558 19014->19016 19017 7ff7e1969814 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 19014->19017 19015->19012 19030 7ff7e19715d4 19016->19030 19019 7ff7e196a5d5 19017->19019 19020 7ff7e196a57c 19018->19020 19021 7ff7e196a59a FlsSetValue 19020->19021 19022 7ff7e196a58a FlsSetValue 19020->19022 19024 7ff7e196a5b8 19021->19024 19025 7ff7e196a5a6 FlsSetValue 19021->19025 19023 7ff7e196a593 19022->19023 19026 7ff7e1969c58 __free_lconv_num 11 API calls 19023->19026 19027 7ff7e196a204 _get_daylight 11 API calls 19024->19027 19025->19023 19026->19014 19028 7ff7e196a5c0 19027->19028 19029 7ff7e1969c58 __free_lconv_num 11 API calls 19028->19029 19029->19016 19053 7ff7e1971844 19030->19053 19032 7ff7e1971609 19068 7ff7e19712d4 19032->19068 19035 7ff7e1971626 19035->18967 19036 7ff7e196c90c _fread_nolock 12 API calls 19037 7ff7e1971637 19036->19037 19038 7ff7e197163f 19037->19038 19040 7ff7e197164e 19037->19040 19039 7ff7e1969c58 __free_lconv_num 11 API calls 19038->19039 19039->19035 19040->19040 19075 7ff7e197197c 19040->19075 19043 7ff7e197174a 19044 7ff7e19643f4 _get_daylight 11 API calls 19043->19044 19045 7ff7e197174f 19044->19045 19047 7ff7e1969c58 __free_lconv_num 11 API calls 19045->19047 19046 7ff7e19717a5 19049 7ff7e197180c 19046->19049 19086 7ff7e1971104 19046->19086 19047->19035 19048 7ff7e1971764 19048->19046 19051 7ff7e1969c58 __free_lconv_num 11 API calls 19048->19051 19050 7ff7e1969c58 __free_lconv_num 11 API calls 19049->19050 19050->19035 19051->19046 19054 7ff7e1971867 19053->19054 19056 7ff7e1971871 19054->19056 19101 7ff7e196f5e8 EnterCriticalSection 19054->19101 19058 7ff7e19718e3 19056->19058 19060 7ff7e1969814 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 19056->19060 19058->19032 19062 7ff7e19718fb 19060->19062 19063 7ff7e1971952 19062->19063 19065 7ff7e196a534 50 API calls 19062->19065 19063->19032 19066 7ff7e197193c 19065->19066 19067 7ff7e19715d4 65 API calls 19066->19067 19067->19063 19069 7ff7e1964178 45 API calls 19068->19069 19070 7ff7e19712e8 19069->19070 19071 7ff7e1971306 19070->19071 19072 7ff7e19712f4 GetOEMCP 19070->19072 19073 7ff7e197130b GetACP 19071->19073 19074 7ff7e197131b 19071->19074 19072->19074 19073->19074 19074->19035 19074->19036 19076 7ff7e19712d4 47 API calls 19075->19076 19077 7ff7e19719a9 19076->19077 19078 7ff7e1971aff 19077->19078 19080 7ff7e19719e6 IsValidCodePage 19077->19080 19085 7ff7e1971a00 memcpy_s 19077->19085 19079 7ff7e195b870 _log10_special 8 API calls 19078->19079 19082 7ff7e1971741 19079->19082 19080->19078 19081 7ff7e19719f7 19080->19081 19083 7ff7e1971a26 GetCPInfo 19081->19083 19081->19085 19082->19043 19082->19048 19083->19078 19083->19085 19102 7ff7e19713ec 19085->19102 19158 7ff7e196f5e8 EnterCriticalSection 19086->19158 19103 7ff7e1971429 GetCPInfo 19102->19103 19104 7ff7e197151f 19102->19104 19103->19104 19109 7ff7e197143c 19103->19109 19105 7ff7e195b870 _log10_special 8 API calls 19104->19105 19106 7ff7e19715be 19105->19106 19106->19078 19107 7ff7e1972150 48 API calls 19108 7ff7e19714b3 19107->19108 19113 7ff7e1976e94 19108->19113 19109->19107 19112 7ff7e1976e94 54 API calls 19112->19104 19114 7ff7e1964178 45 API calls 19113->19114 19115 7ff7e1976eb9 19114->19115 19118 7ff7e1976b60 19115->19118 19119 7ff7e1976ba1 19118->19119 19120 7ff7e196ebb0 _fread_nolock MultiByteToWideChar 19119->19120 19123 7ff7e1976beb 19120->19123 19121 7ff7e1976e69 19122 7ff7e195b870 _log10_special 8 API calls 19121->19122 19124 7ff7e19714e6 19122->19124 19123->19121 19125 7ff7e196c90c _fread_nolock 12 API calls 19123->19125 19127 7ff7e1976c23 19123->19127 19148 7ff7e1976d21 19123->19148 19124->19112 19125->19127 19126 7ff7e1969c58 __free_lconv_num 11 API calls 19126->19121 19128 7ff7e196ebb0 _fread_nolock MultiByteToWideChar 19127->19128 19127->19148 19129 7ff7e1976c96 19128->19129 19129->19148 19149 7ff7e196e3f4 19129->19149 19132 7ff7e1976ce1 19135 7ff7e196e3f4 __crtLCMapStringW 6 API calls 19132->19135 19132->19148 19133 7ff7e1976d32 19134 7ff7e196c90c _fread_nolock 12 API calls 19133->19134 19136 7ff7e1976e04 19133->19136 19137 7ff7e1976d50 19133->19137 19134->19137 19135->19148 19138 7ff7e1969c58 __free_lconv_num 11 API calls 19136->19138 19136->19148 19139 7ff7e196e3f4 __crtLCMapStringW 6 API calls 19137->19139 19137->19148 19138->19148 19140 7ff7e1976dd0 19139->19140 19140->19136 19141 7ff7e1976e06 19140->19141 19142 7ff7e1976df0 19140->19142 19143 7ff7e196faf8 WideCharToMultiByte 19141->19143 19144 7ff7e196faf8 WideCharToMultiByte 19142->19144 19145 7ff7e1976dfe 19143->19145 19144->19145 19145->19136 19146 7ff7e1976e1e 19145->19146 19147 7ff7e1969c58 __free_lconv_num 11 API calls 19146->19147 19146->19148 19147->19148 19148->19121 19148->19126 19150 7ff7e196e020 __crtLCMapStringW 5 API calls 19149->19150 19151 7ff7e196e432 19150->19151 19152 7ff7e196e43a 19151->19152 19155 7ff7e196e4e0 19151->19155 19152->19132 19152->19133 19152->19148 19154 7ff7e196e4a3 LCMapStringW 19154->19152 19156 7ff7e196e020 __crtLCMapStringW 5 API calls 19155->19156 19157 7ff7e196e50e __crtLCMapStringW 19156->19157 19157->19154 19160 7ff7e19687c5 19159->19160 19161 7ff7e1968661 19159->19161 19162 7ff7e19687ee 19160->19162 19163 7ff7e1969c58 __free_lconv_num 11 API calls 19160->19163 19161->19006 19164 7ff7e1969c58 __free_lconv_num 11 API calls 19162->19164 19163->19160 19164->19161 19166 7ff7e19755e8 19165->19166 19167 7ff7e19755d1 19165->19167 19166->19167 19171 7ff7e19755f6 19166->19171 19168 7ff7e19643f4 _get_daylight 11 API calls 19167->19168 19169 7ff7e19755d6 19168->19169 19170 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 19169->19170 19173 7ff7e19755e1 19170->19173 19172 7ff7e1964178 45 API calls 19171->19172 19171->19173 19172->19173 19173->18868 19175 7ff7e1964178 45 API calls 19174->19175 19176 7ff7e1978281 19175->19176 19179 7ff7e1977ed8 19176->19179 19181 7ff7e1977f26 19179->19181 19180 7ff7e195b870 _log10_special 8 API calls 19182 7ff7e1976515 19180->19182 19183 7ff7e1977fad 19181->19183 19185 7ff7e1977f98 GetCPInfo 19181->19185 19186 7ff7e1977fb1 19181->19186 19182->18867 19182->18868 19184 7ff7e196ebb0 _fread_nolock MultiByteToWideChar 19183->19184 19183->19186 19187 7ff7e1978045 19184->19187 19185->19183 19185->19186 19186->19180 19187->19186 19188 7ff7e196c90c _fread_nolock 12 API calls 19187->19188 19189 7ff7e197807c 19187->19189 19188->19189 19189->19186 19190 7ff7e196ebb0 _fread_nolock MultiByteToWideChar 19189->19190 19191 7ff7e19780ea 19190->19191 19192 7ff7e19781cc 19191->19192 19193 7ff7e196ebb0 _fread_nolock MultiByteToWideChar 19191->19193 19192->19186 19194 7ff7e1969c58 __free_lconv_num 11 API calls 19192->19194 19195 7ff7e1978110 19193->19195 19194->19186 19195->19192 19196 7ff7e196c90c _fread_nolock 12 API calls 19195->19196 19197 7ff7e197813d 19195->19197 19196->19197 19197->19192 19198 7ff7e196ebb0 _fread_nolock MultiByteToWideChar 19197->19198 19199 7ff7e19781b4 19198->19199 19200 7ff7e19781ba 19199->19200 19201 7ff7e19781d4 19199->19201 19200->19192 19203 7ff7e1969c58 __free_lconv_num 11 API calls 19200->19203 19208 7ff7e196e278 19201->19208 19203->19192 19205 7ff7e1978213 19205->19186 19207 7ff7e1969c58 __free_lconv_num 11 API calls 19205->19207 19206 7ff7e1969c58 __free_lconv_num 11 API calls 19206->19205 19207->19186 19209 7ff7e196e020 __crtLCMapStringW 5 API calls 19208->19209 19210 7ff7e196e2b6 19209->19210 19211 7ff7e196e4e0 __crtLCMapStringW 5 API calls 19210->19211 19212 7ff7e196e2be 19210->19212 19213 7ff7e196e327 CompareStringW 19211->19213 19212->19205 19212->19206 19213->19212 19215 7ff7e1976f6a HeapSize 19214->19215 19216 7ff7e1976f51 19214->19216 19217 7ff7e19643f4 _get_daylight 11 API calls 19216->19217 19218 7ff7e1976f56 19217->19218 19219 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 19218->19219 19220 7ff7e1976f61 19219->19220 19220->18875 19222 7ff7e1976f99 19221->19222 19223 7ff7e1976fa3 19221->19223 19224 7ff7e196c90c _fread_nolock 12 API calls 19222->19224 19225 7ff7e1976fa8 19223->19225 19232 7ff7e1976faf _get_daylight 19223->19232 19226 7ff7e1976fa1 19224->19226 19227 7ff7e1969c58 __free_lconv_num 11 API calls 19225->19227 19226->18877 19227->19226 19228 7ff7e1976fb5 19230 7ff7e19643f4 _get_daylight 11 API calls 19228->19230 19229 7ff7e1976fe2 HeapReAlloc 19229->19226 19229->19232 19230->19226 19231 7ff7e19728a0 _get_daylight 2 API calls 19231->19232 19232->19228 19232->19229 19232->19231 19234 7ff7e196e020 __crtLCMapStringW 5 API calls 19233->19234 19235 7ff7e196e254 19234->19235 19235->18882 19237 7ff7e196480a 19236->19237 19238 7ff7e19647e6 19236->19238 19239 7ff7e1964864 19237->19239 19240 7ff7e196480f 19237->19240 19242 7ff7e1969c58 __free_lconv_num 11 API calls 19238->19242 19244 7ff7e19647f5 19238->19244 19241 7ff7e196ebb0 _fread_nolock MultiByteToWideChar 19239->19241 19240->19244 19245 7ff7e1969c58 __free_lconv_num 11 API calls 19240->19245 19248 7ff7e1964824 19240->19248 19243 7ff7e1964880 19241->19243 19242->19244 19247 7ff7e1964887 GetLastError 19243->19247 19250 7ff7e19648b5 19243->19250 19253 7ff7e1969c58 __free_lconv_num 11 API calls 19243->19253 19257 7ff7e19648c2 19243->19257 19244->18885 19244->18886 19245->19248 19246 7ff7e196c90c _fread_nolock 12 API calls 19246->19244 19249 7ff7e1964368 _fread_nolock 11 API calls 19247->19249 19248->19246 19252 7ff7e1964894 19249->19252 19254 7ff7e196c90c _fread_nolock 12 API calls 19250->19254 19251 7ff7e196ebb0 _fread_nolock MultiByteToWideChar 19255 7ff7e1964906 19251->19255 19256 7ff7e19643f4 _get_daylight 11 API calls 19252->19256 19253->19250 19254->19257 19255->19244 19255->19247 19256->19244 19257->19244 19257->19251 19259 7ff7e196853d 19258->19259 19260 7ff7e1968539 19258->19260 19279 7ff7e1971d4c GetEnvironmentStringsW 19259->19279 19260->18914 19271 7ff7e19688e4 19260->19271 19263 7ff7e196854a 19265 7ff7e1969c58 __free_lconv_num 11 API calls 19263->19265 19264 7ff7e1968556 19286 7ff7e19686a4 19264->19286 19265->19260 19268 7ff7e1969c58 __free_lconv_num 11 API calls 19269 7ff7e196857d 19268->19269 19270 7ff7e1969c58 __free_lconv_num 11 API calls 19269->19270 19270->19260 19272 7ff7e1968907 19271->19272 19274 7ff7e196891e 19271->19274 19272->18914 19273 7ff7e196ebb0 MultiByteToWideChar _fread_nolock 19273->19274 19274->19272 19274->19273 19275 7ff7e196dea8 _get_daylight 11 API calls 19274->19275 19276 7ff7e1968992 19274->19276 19278 7ff7e1969c58 __free_lconv_num 11 API calls 19274->19278 19275->19274 19277 7ff7e1969c58 __free_lconv_num 11 API calls 19276->19277 19277->19272 19278->19274 19280 7ff7e1968542 19279->19280 19281 7ff7e1971d70 19279->19281 19280->19263 19280->19264 19282 7ff7e196c90c _fread_nolock 12 API calls 19281->19282 19284 7ff7e1971da7 memcpy_s 19282->19284 19283 7ff7e1969c58 __free_lconv_num 11 API calls 19285 7ff7e1971dc7 FreeEnvironmentStringsW 19283->19285 19284->19283 19285->19280 19287 7ff7e19686cc 19286->19287 19287->19287 19288 7ff7e196dea8 _get_daylight 11 API calls 19287->19288 19300 7ff7e1968707 19288->19300 19289 7ff7e196870f 19290 7ff7e1969c58 __free_lconv_num 11 API calls 19289->19290 19291 7ff7e196855e 19290->19291 19291->19268 19292 7ff7e1968789 19293 7ff7e1969c58 __free_lconv_num 11 API calls 19292->19293 19293->19291 19294 7ff7e196dea8 _get_daylight 11 API calls 19294->19300 19295 7ff7e1968778 19297 7ff7e19687c0 11 API calls 19295->19297 19296 7ff7e196f784 37 API calls 19296->19300 19298 7ff7e1968780 19297->19298 19301 7ff7e1969c58 __free_lconv_num 11 API calls 19298->19301 19299 7ff7e19687ac 19302 7ff7e1969c10 _isindst 17 API calls 19299->19302 19300->19289 19300->19292 19300->19294 19300->19295 19300->19296 19300->19299 19303 7ff7e1969c58 __free_lconv_num 11 API calls 19300->19303 19301->19289 19304 7ff7e19687be 19302->19304 19303->19300 19306 7ff7e1977e41 __crtLCMapStringW 19305->19306 19307 7ff7e196e278 6 API calls 19306->19307 19308 7ff7e19763fe 19306->19308 19307->19308 19308->18940 19308->18941 19830 7ff7e196a2e0 19831 7ff7e196a2e5 19830->19831 19832 7ff7e196a2fa 19830->19832 19836 7ff7e196a300 19831->19836 19837 7ff7e196a34a 19836->19837 19838 7ff7e196a342 19836->19838 19840 7ff7e1969c58 __free_lconv_num 11 API calls 19837->19840 19839 7ff7e1969c58 __free_lconv_num 11 API calls 19838->19839 19839->19837 19841 7ff7e196a357 19840->19841 19842 7ff7e1969c58 __free_lconv_num 11 API calls 19841->19842 19843 7ff7e196a364 19842->19843 19844 7ff7e1969c58 __free_lconv_num 11 API calls 19843->19844 19845 7ff7e196a371 19844->19845 19846 7ff7e1969c58 __free_lconv_num 11 API calls 19845->19846 19847 7ff7e196a37e 19846->19847 19848 7ff7e1969c58 __free_lconv_num 11 API calls 19847->19848 19849 7ff7e196a38b 19848->19849 19850 7ff7e1969c58 __free_lconv_num 11 API calls 19849->19850 19851 7ff7e196a398 19850->19851 19852 7ff7e1969c58 __free_lconv_num 11 API calls 19851->19852 19853 7ff7e196a3a5 19852->19853 19854 7ff7e1969c58 __free_lconv_num 11 API calls 19853->19854 19855 7ff7e196a3b5 19854->19855 19856 7ff7e1969c58 __free_lconv_num 11 API calls 19855->19856 19857 7ff7e196a3c5 19856->19857 19862 7ff7e196a1a4 19857->19862 19876 7ff7e196f5e8 EnterCriticalSection 19862->19876 20161 7ff7e1969060 20164 7ff7e1968fe4 20161->20164 20171 7ff7e196f5e8 EnterCriticalSection 20164->20171 19894 7ff7e1979ef3 19895 7ff7e1979f03 19894->19895 19898 7ff7e1964788 LeaveCriticalSection 19895->19898 20193 7ff7e195be70 20194 7ff7e195be80 20193->20194 20210 7ff7e1968ec0 20194->20210 20196 7ff7e195be8c 20216 7ff7e195c168 20196->20216 20198 7ff7e195bef9 20199 7ff7e195c44c 7 API calls 20198->20199 20209 7ff7e195bf15 20198->20209 20201 7ff7e195bf25 20199->20201 20200 7ff7e195bea4 _RTC_Initialize 20200->20198 20221 7ff7e195c318 20200->20221 20203 7ff7e195beb9 20224 7ff7e196832c 20203->20224 20211 7ff7e1968ed1 20210->20211 20212 7ff7e1968ed9 20211->20212 20213 7ff7e19643f4 _get_daylight 11 API calls 20211->20213 20212->20196 20214 7ff7e1968ee8 20213->20214 20215 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 20214->20215 20215->20212 20217 7ff7e195c179 20216->20217 20220 7ff7e195c17e __scrt_acquire_startup_lock 20216->20220 20218 7ff7e195c44c 7 API calls 20217->20218 20217->20220 20219 7ff7e195c1f2 20218->20219 20220->20200 20249 7ff7e195c2dc 20221->20249 20223 7ff7e195c321 20223->20203 20225 7ff7e196834c 20224->20225 20240 7ff7e195bec5 20224->20240 20226 7ff7e196836a GetModuleFileNameW 20225->20226 20227 7ff7e1968354 20225->20227 20231 7ff7e1968395 20226->20231 20228 7ff7e19643f4 _get_daylight 11 API calls 20227->20228 20229 7ff7e1968359 20228->20229 20230 7ff7e1969bf0 _invalid_parameter_noinfo 37 API calls 20229->20230 20230->20240 20232 7ff7e19682cc 11 API calls 20231->20232 20233 7ff7e19683d5 20232->20233 20234 7ff7e19683dd 20233->20234 20238 7ff7e19683f5 20233->20238 20235 7ff7e19643f4 _get_daylight 11 API calls 20234->20235 20236 7ff7e19683e2 20235->20236 20237 7ff7e1969c58 __free_lconv_num 11 API calls 20236->20237 20237->20240 20239 7ff7e1968417 20238->20239 20242 7ff7e196845c 20238->20242 20243 7ff7e1968443 20238->20243 20241 7ff7e1969c58 __free_lconv_num 11 API calls 20239->20241 20240->20198 20248 7ff7e195c3ec InitializeSListHead 20240->20248 20241->20240 20246 7ff7e1969c58 __free_lconv_num 11 API calls 20242->20246 20244 7ff7e1969c58 __free_lconv_num 11 API calls 20243->20244 20245 7ff7e196844c 20244->20245 20247 7ff7e1969c58 __free_lconv_num 11 API calls 20245->20247 20246->20239 20247->20240 20250 7ff7e195c2f6 20249->20250 20252 7ff7e195c2ef 20249->20252 20253 7ff7e19694fc 20250->20253 20252->20223 20256 7ff7e1969138 20253->20256 20263 7ff7e196f5e8 EnterCriticalSection 20256->20263

                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                              Function 00007FF7E1951000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 0 7ff7e1951000-7ff7e1953536 call 7ff7e195f138 call 7ff7e195f140 call 7ff7e195bb70 call 7ff7e1964700 call 7ff7e1964794 call 7ff7e19533e0 14 7ff7e1953538-7ff7e195353f 0->14 15 7ff7e1953544-7ff7e1953566 call 7ff7e19518f0 0->15 16 7ff7e195371a-7ff7e1953735 call 7ff7e195b870 14->16 21 7ff7e195356c-7ff7e1953583 call 7ff7e1951bf0 15->21 22 7ff7e1953736-7ff7e195374c call 7ff7e1953f70 15->22 25 7ff7e1953588-7ff7e19535c1 21->25 29 7ff7e195374e-7ff7e195377b call 7ff7e19576a0 22->29 30 7ff7e1953785-7ff7e195379a call 7ff7e19525f0 22->30 27 7ff7e19535c7-7ff7e19535cb 25->27 28 7ff7e1953653-7ff7e195366d call 7ff7e1957e10 25->28 31 7ff7e19535cd-7ff7e19535e5 call 7ff7e1964560 27->31 32 7ff7e1953638-7ff7e195364d call 7ff7e19518e0 27->32 45 7ff7e1953695-7ff7e195369c 28->45 46 7ff7e195366f-7ff7e1953675 28->46 41 7ff7e195377d-7ff7e1953780 call 7ff7e195f36c 29->41 42 7ff7e195379f-7ff7e19537be call 7ff7e1951bf0 29->42 47 7ff7e1953712 30->47 50 7ff7e19535e7-7ff7e19535eb 31->50 51 7ff7e19535f2-7ff7e195360a call 7ff7e1964560 31->51 32->27 32->28 41->30 61 7ff7e19537c1-7ff7e19537ca 42->61 54 7ff7e1953844-7ff7e1953863 call 7ff7e1953e90 45->54 55 7ff7e19536a2-7ff7e19536c0 call 7ff7e1957e10 call 7ff7e1957f80 45->55 52 7ff7e1953677-7ff7e1953680 46->52 53 7ff7e1953682-7ff7e1953690 call 7ff7e196415c 46->53 47->16 50->51 66 7ff7e195360c-7ff7e1953610 51->66 67 7ff7e1953617-7ff7e195362f call 7ff7e1964560 51->67 52->53 53->45 69 7ff7e1953865-7ff7e195386f call 7ff7e1953fe0 54->69 70 7ff7e1953871-7ff7e1953882 call 7ff7e1951bf0 54->70 80 7ff7e19536c6-7ff7e19536c9 55->80 81 7ff7e195380f-7ff7e195381e call 7ff7e1958400 55->81 61->61 65 7ff7e19537cc-7ff7e19537e9 call 7ff7e19518f0 61->65 65->25 85 7ff7e19537ef-7ff7e1953800 call 7ff7e19525f0 65->85 66->67 67->32 86 7ff7e1953631 67->86 77 7ff7e1953887-7ff7e19538a1 call 7ff7e19586b0 69->77 70->77 94 7ff7e19538a3 77->94 95 7ff7e19538af-7ff7e19538c1 SetDllDirectoryW 77->95 80->81 82 7ff7e19536cf-7ff7e19536f6 call 7ff7e1951bf0 80->82 92 7ff7e195382c-7ff7e195382f call 7ff7e1957c40 81->92 93 7ff7e1953820 81->93 97 7ff7e19536fc-7ff7e1953703 call 7ff7e19525f0 82->97 98 7ff7e1953805-7ff7e195380d call 7ff7e196415c 82->98 85->47 86->32 104 7ff7e1953834-7ff7e1953836 92->104 93->92 94->95 100 7ff7e19538c3-7ff7e19538ca 95->100 101 7ff7e19538d0-7ff7e19538ec call 7ff7e1956560 call 7ff7e1956b00 95->101 108 7ff7e1953708-7ff7e195370a 97->108 98->77 100->101 105 7ff7e1953a50-7ff7e1953a58 100->105 117 7ff7e19538ee-7ff7e19538f4 101->117 118 7ff7e1953947-7ff7e195394a call 7ff7e1956510 101->118 104->77 111 7ff7e1953838 104->111 109 7ff7e1953a7d-7ff7e1953aaf call 7ff7e19533d0 call 7ff7e1953080 call 7ff7e19533a0 call 7ff7e1956780 call 7ff7e1956510 105->109 110 7ff7e1953a5a-7ff7e1953a77 PostMessageW GetMessageW 105->110 108->47 110->109 111->54 120 7ff7e195390e-7ff7e1953918 call 7ff7e1956970 117->120 121 7ff7e19538f6-7ff7e1953903 call 7ff7e19565a0 117->121 125 7ff7e195394f-7ff7e1953956 118->125 134 7ff7e195391a-7ff7e1953921 120->134 135 7ff7e1953923-7ff7e1953931 call 7ff7e1956cd0 120->135 121->120 132 7ff7e1953905-7ff7e195390c 121->132 125->105 129 7ff7e195395c-7ff7e1953966 call 7ff7e19530e0 125->129 129->108 142 7ff7e195396c-7ff7e1953980 call 7ff7e19583e0 129->142 138 7ff7e195393a-7ff7e1953942 call 7ff7e1952870 call 7ff7e1956780 132->138 134->138 135->125 147 7ff7e1953933 135->147 138->118 151 7ff7e19539a5-7ff7e19539e1 call 7ff7e1957f20 call 7ff7e1957fc0 call 7ff7e1956780 call 7ff7e1956510 call 7ff7e1957ec0 142->151 152 7ff7e1953982-7ff7e195399f PostMessageW GetMessageW 142->152 147->138 162 7ff7e19539e6-7ff7e19539e8 151->162 152->151 163 7ff7e1953a3d-7ff7e1953a4b call 7ff7e19518a0 162->163 164 7ff7e19539ea-7ff7e1953a00 call 7ff7e19581f0 call 7ff7e1957ec0 162->164 163->108 164->163 171 7ff7e1953a02-7ff7e1953a10 164->171 172 7ff7e1953a31-7ff7e1953a38 call 7ff7e1952870 171->172 173 7ff7e1953a12-7ff7e1953a2c call 7ff7e19525f0 call 7ff7e19518a0 171->173 172->163 173->108
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: FileModuleName
                                                                                                                                                                                                                              • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
                                                                                                                                                                                                                              • API String ID: 514040917-585287483
                                                                                                                                                                                                                              • Opcode ID: 1ab915059f083da480bb5f8b0769b4ec97db141b1d5f92c49b7faf13479d9f29
                                                                                                                                                                                                                              • Instruction ID: 1cd03cd531fb3a438e49512050b0970dbeffaae85c53bd43ec5877c33cdfaf3f
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1ab915059f083da480bb5f8b0769b4ec97db141b1d5f92c49b7faf13479d9f29
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 51F16F61A086C2A1EB19FB21D5663F9A351BF44788FC44033DA1D53696EFBCE658C332
                                                                                                                                                                                                                              Function 00007FF7E1974F10 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 305 7ff7e1974f10-7ff7e1974f4b call 7ff7e1974898 call 7ff7e19748a0 call 7ff7e1974908 312 7ff7e1975175-7ff7e19751c1 call 7ff7e1969c10 call 7ff7e1974898 call 7ff7e19748a0 call 7ff7e1974908 305->312 313 7ff7e1974f51-7ff7e1974f5c call 7ff7e19748a8 305->313 338 7ff7e19751c7-7ff7e19751d2 call 7ff7e19748a8 312->338 339 7ff7e19752ff-7ff7e197536d call 7ff7e1969c10 call 7ff7e1970888 312->339 313->312 318 7ff7e1974f62-7ff7e1974f6c 313->318 320 7ff7e1974f8e-7ff7e1974f92 318->320 321 7ff7e1974f6e-7ff7e1974f71 318->321 324 7ff7e1974f95-7ff7e1974f9d 320->324 323 7ff7e1974f74-7ff7e1974f7f 321->323 326 7ff7e1974f8a-7ff7e1974f8c 323->326 327 7ff7e1974f81-7ff7e1974f88 323->327 324->324 328 7ff7e1974f9f-7ff7e1974fb2 call 7ff7e196c90c 324->328 326->320 330 7ff7e1974fbb-7ff7e1974fc9 326->330 327->323 327->326 336 7ff7e1974fca-7ff7e1974fd6 call 7ff7e1969c58 328->336 337 7ff7e1974fb4-7ff7e1974fb6 call 7ff7e1969c58 328->337 345 7ff7e1974fdd-7ff7e1974fe5 336->345 337->330 338->339 349 7ff7e19751d8-7ff7e19751e3 call 7ff7e19748d8 338->349 357 7ff7e197537b-7ff7e197537e 339->357 358 7ff7e197536f-7ff7e1975376 339->358 345->345 348 7ff7e1974fe7-7ff7e1974ff8 call 7ff7e196f784 345->348 348->312 359 7ff7e1974ffe-7ff7e1975054 call 7ff7e19797e0 * 4 call 7ff7e1974e2c 348->359 349->339 360 7ff7e19751e9-7ff7e197520c call 7ff7e1969c58 GetTimeZoneInformation 349->360 362 7ff7e19753b5-7ff7e19753c8 call 7ff7e196c90c 357->362 363 7ff7e1975380 357->363 361 7ff7e197540b-7ff7e197540e 358->361 418 7ff7e1975056-7ff7e197505a 359->418 373 7ff7e19752d4-7ff7e19752fe call 7ff7e1974890 call 7ff7e1974880 call 7ff7e1974888 360->373 374 7ff7e1975212-7ff7e1975233 360->374 366 7ff7e1975383 call 7ff7e197518c 361->366 369 7ff7e1975414-7ff7e197541c call 7ff7e1974f10 361->369 383 7ff7e19753ca 362->383 384 7ff7e19753d3-7ff7e19753ee call 7ff7e1970888 362->384 363->366 377 7ff7e1975388-7ff7e19753b4 call 7ff7e1969c58 call 7ff7e195b870 366->377 369->377 379 7ff7e197523e-7ff7e1975245 374->379 380 7ff7e1975235-7ff7e197523b 374->380 389 7ff7e1975259 379->389 390 7ff7e1975247-7ff7e197524f 379->390 380->379 385 7ff7e19753cc-7ff7e19753d1 call 7ff7e1969c58 383->385 402 7ff7e19753f5-7ff7e1975407 call 7ff7e1969c58 384->402 403 7ff7e19753f0-7ff7e19753f3 384->403 385->363 397 7ff7e197525b-7ff7e19752cf call 7ff7e19797e0 * 4 call 7ff7e1971e6c call 7ff7e1975424 * 2 389->397 390->389 398 7ff7e1975251-7ff7e1975257 390->398 397->373 398->397 402->361 403->385 419 7ff7e197505c 418->419 420 7ff7e1975060-7ff7e1975064 418->420 419->420 420->418 422 7ff7e1975066-7ff7e197508b call 7ff7e1965e68 420->422 428 7ff7e197508e-7ff7e1975092 422->428 430 7ff7e1975094-7ff7e197509f 428->430 431 7ff7e19750a1-7ff7e19750a5 428->431 430->431 433 7ff7e19750a7-7ff7e19750ab 430->433 431->428 435 7ff7e19750ad-7ff7e19750d5 call 7ff7e1965e68 433->435 436 7ff7e197512c-7ff7e1975130 433->436 445 7ff7e19750d7 435->445 446 7ff7e19750f3-7ff7e19750f7 435->446 438 7ff7e1975137-7ff7e1975144 436->438 439 7ff7e1975132-7ff7e1975134 436->439 441 7ff7e1975146-7ff7e197515c call 7ff7e1974e2c 438->441 442 7ff7e197515f-7ff7e197516e call 7ff7e1974890 call 7ff7e1974880 438->442 439->438 441->442 442->312 450 7ff7e19750da-7ff7e19750e1 445->450 446->436 448 7ff7e19750f9-7ff7e1975117 call 7ff7e1965e68 446->448 457 7ff7e1975123-7ff7e197512a 448->457 450->446 453 7ff7e19750e3-7ff7e19750f1 450->453 453->446 453->450 457->436 458 7ff7e1975119-7ff7e197511d 457->458 458->436 459 7ff7e197511f 458->459 459->457
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7E1974F55
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E19748A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E19748BC
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1969C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7E1972032,?,?,?,00007FF7E197206F,?,?,00000000,00007FF7E1972535,?,?,?,00007FF7E1972467), ref: 00007FF7E1969C6E
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1969C58: GetLastError.KERNEL32(?,?,?,00007FF7E1972032,?,?,?,00007FF7E197206F,?,?,00000000,00007FF7E1972535,?,?,?,00007FF7E1972467), ref: 00007FF7E1969C78
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1969C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7E1969BEF,?,?,?,?,?,00007FF7E1969ADA), ref: 00007FF7E1969C19
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1969C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7E1969BEF,?,?,?,?,?,00007FF7E1969ADA), ref: 00007FF7E1969C3E
                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7E1974F44
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1974908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E197491C
                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7E19751BA
                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7E19751CB
                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7E19751DC
                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E197541C), ref: 00007FF7E1975203
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                              • API String ID: 4070488512-239921721
                                                                                                                                                                                                                              • Opcode ID: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
                                                                                                                                                                                                                              • Instruction ID: ef2c8cad8c9f1129690e282913356e7928212ec4dedfe8f03f1d666116b50782
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 12D1A066E1828286F760BF25D4523B9A3A1FF44B98FC44137EA0D47696DFBCE441C362
                                                                                                                                                                                                                              Function 00007FF7E1975C74 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 490 7ff7e1975c74-7ff7e1975ce7 call 7ff7e19759a8 493 7ff7e1975ce9-7ff7e1975cf2 call 7ff7e19643d4 490->493 494 7ff7e1975d01-7ff7e1975d0b call 7ff7e1967830 490->494 501 7ff7e1975cf5-7ff7e1975cfc call 7ff7e19643f4 493->501 499 7ff7e1975d0d-7ff7e1975d24 call 7ff7e19643d4 call 7ff7e19643f4 494->499 500 7ff7e1975d26-7ff7e1975d8f CreateFileW 494->500 499->501 503 7ff7e1975e0c-7ff7e1975e17 GetFileType 500->503 504 7ff7e1975d91-7ff7e1975d97 500->504 512 7ff7e1976042-7ff7e1976062 501->512 506 7ff7e1975e19-7ff7e1975e54 GetLastError call 7ff7e1964368 CloseHandle 503->506 507 7ff7e1975e6a-7ff7e1975e71 503->507 509 7ff7e1975dd9-7ff7e1975e07 GetLastError call 7ff7e1964368 504->509 510 7ff7e1975d99-7ff7e1975d9d 504->510 506->501 524 7ff7e1975e5a-7ff7e1975e65 call 7ff7e19643f4 506->524 515 7ff7e1975e79-7ff7e1975e7c 507->515 516 7ff7e1975e73-7ff7e1975e77 507->516 509->501 510->509 517 7ff7e1975d9f-7ff7e1975dd7 CreateFileW 510->517 521 7ff7e1975e82-7ff7e1975ed7 call 7ff7e1967748 515->521 522 7ff7e1975e7e 515->522 516->521 517->503 517->509 529 7ff7e1975ed9-7ff7e1975ee5 call 7ff7e1975bb0 521->529 530 7ff7e1975ef6-7ff7e1975f27 call 7ff7e1975728 521->530 522->521 524->501 529->530 535 7ff7e1975ee7 529->535 536 7ff7e1975f2d-7ff7e1975f6f 530->536 537 7ff7e1975f29-7ff7e1975f2b 530->537 538 7ff7e1975ee9-7ff7e1975ef1 call 7ff7e1969dd0 535->538 539 7ff7e1975f91-7ff7e1975f9c 536->539 540 7ff7e1975f71-7ff7e1975f75 536->540 537->538 538->512 543 7ff7e1975fa2-7ff7e1975fa6 539->543 544 7ff7e1976040 539->544 540->539 542 7ff7e1975f77-7ff7e1975f8c 540->542 542->539 543->544 546 7ff7e1975fac-7ff7e1975ff1 CloseHandle CreateFileW 543->546 544->512 547 7ff7e1976026-7ff7e197603b 546->547 548 7ff7e1975ff3-7ff7e1976021 GetLastError call 7ff7e1964368 call 7ff7e1967970 546->548 547->544 548->547
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1617910340-0
                                                                                                                                                                                                                              • Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
                                                                                                                                                                                                                              • Instruction ID: ff3788cca1e77381dffe2a3f53a58311bee40272738d72c0aa3248eb9d5da872
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22C1D272B28A8186EB50DF68C4927AC7761FB49B98B414236DF1E57794CF78E051C321
                                                                                                                                                                                                                              Function 00007FF7E19579B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • FindFirstFileW.KERNELBASE(?,00007FF7E1957EF9,00007FF7E19539E6), ref: 00007FF7E1957A1B
                                                                                                                                                                                                                              • RemoveDirectoryW.KERNEL32(?,00007FF7E1957EF9,00007FF7E19539E6), ref: 00007FF7E1957A9E
                                                                                                                                                                                                                              • DeleteFileW.KERNELBASE(?,00007FF7E1957EF9,00007FF7E19539E6), ref: 00007FF7E1957ABD
                                                                                                                                                                                                                              • FindNextFileW.KERNELBASE(?,00007FF7E1957EF9,00007FF7E19539E6), ref: 00007FF7E1957ACB
                                                                                                                                                                                                                              • FindClose.KERNELBASE(?,00007FF7E1957EF9,00007FF7E19539E6), ref: 00007FF7E1957ADC
                                                                                                                                                                                                                              • RemoveDirectoryW.KERNELBASE(?,00007FF7E1957EF9,00007FF7E19539E6), ref: 00007FF7E1957AE5
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                                              • String ID: %s\*
                                                                                                                                                                                                                              • API String ID: 1057558799-766152087
                                                                                                                                                                                                                              • Opcode ID: 28b17b752644ad79b76fdaecccd908953f702e209cd2b6248263d266171aeab9
                                                                                                                                                                                                                              • Instruction ID: 1ee6c5d55b866fa450b4855f8b4054aa9bae42a2a9cd6fdb5cc711f1d29271b9
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 28b17b752644ad79b76fdaecccd908953f702e209cd2b6248263d266171aeab9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 41419221A0C5C295EB20AB64E4666B9A360FF94758FC00633E55E52684DFBCD74AC732
                                                                                                                                                                                                                              Function 00007FF7E197518C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 840 7ff7e197518c-7ff7e19751c1 call 7ff7e1974898 call 7ff7e19748a0 call 7ff7e1974908 847 7ff7e19751c7-7ff7e19751d2 call 7ff7e19748a8 840->847 848 7ff7e19752ff-7ff7e197536d call 7ff7e1969c10 call 7ff7e1970888 840->848 847->848 853 7ff7e19751d8-7ff7e19751e3 call 7ff7e19748d8 847->853 859 7ff7e197537b-7ff7e197537e 848->859 860 7ff7e197536f-7ff7e1975376 848->860 853->848 861 7ff7e19751e9-7ff7e197520c call 7ff7e1969c58 GetTimeZoneInformation 853->861 863 7ff7e19753b5-7ff7e19753c8 call 7ff7e196c90c 859->863 864 7ff7e1975380 859->864 862 7ff7e197540b-7ff7e197540e 860->862 871 7ff7e19752d4-7ff7e19752fe call 7ff7e1974890 call 7ff7e1974880 call 7ff7e1974888 861->871 872 7ff7e1975212-7ff7e1975233 861->872 866 7ff7e1975383 call 7ff7e197518c 862->866 868 7ff7e1975414-7ff7e197541c call 7ff7e1974f10 862->868 880 7ff7e19753ca 863->880 881 7ff7e19753d3-7ff7e19753ee call 7ff7e1970888 863->881 864->866 875 7ff7e1975388-7ff7e19753b4 call 7ff7e1969c58 call 7ff7e195b870 866->875 868->875 876 7ff7e197523e-7ff7e1975245 872->876 877 7ff7e1975235-7ff7e197523b 872->877 885 7ff7e1975259 876->885 886 7ff7e1975247-7ff7e197524f 876->886 877->876 882 7ff7e19753cc-7ff7e19753d1 call 7ff7e1969c58 880->882 897 7ff7e19753f5-7ff7e1975407 call 7ff7e1969c58 881->897 898 7ff7e19753f0-7ff7e19753f3 881->898 882->864 892 7ff7e197525b-7ff7e19752cf call 7ff7e19797e0 * 4 call 7ff7e1971e6c call 7ff7e1975424 * 2 885->892 886->885 893 7ff7e1975251-7ff7e1975257 886->893 892->871 893->892 897->862 898->882
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7E19751BA
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1974908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E197491C
                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7E19751CB
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E19748A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E19748BC
                                                                                                                                                                                                                              • _get_daylight.LIBCMT ref: 00007FF7E19751DC
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E19748D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E19748EC
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1969C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7E1972032,?,?,?,00007FF7E197206F,?,?,00000000,00007FF7E1972535,?,?,?,00007FF7E1972467), ref: 00007FF7E1969C6E
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1969C58: GetLastError.KERNEL32(?,?,?,00007FF7E1972032,?,?,?,00007FF7E197206F,?,?,00000000,00007FF7E1972535,?,?,?,00007FF7E1972467), ref: 00007FF7E1969C78
                                                                                                                                                                                                                              • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E197541C), ref: 00007FF7E1975203
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                              • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                                              • API String ID: 3458911817-239921721
                                                                                                                                                                                                                              • Opcode ID: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
                                                                                                                                                                                                                              • Instruction ID: 7289ff145a6fd555202b593add1ea6d843f6a6193db20383b4e9dcd993cf8c51
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C516071A186C286F750FF25E4822A9E364FF48748F844137EA0D47696DFBCE441C762
                                                                                                                                                                                                                              Function 00007FF7E19585A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2295610775-0
                                                                                                                                                                                                                              • Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
                                                                                                                                                                                                                              • Instruction ID: eebca2a2436ba652a1dcd5b6152bc1b81348dc20cbc6b6743cd002cdd21fb436
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 38F0C822A1D6C1C6F760AF60F45A366B350FB4432CF840336DA6E02AD4CFBCD0598B21
                                                                                                                                                                                                                              Function 00007FF7E196FBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1010374628-0
                                                                                                                                                                                                                              • Opcode ID: 2b6c2d1e4c043c62936e9dac6caf21e199e31a345cf4845f2c7219b702089de4
                                                                                                                                                                                                                              • Instruction ID: 56a22ab2d8a44963c86bbe9682e45723b2cd9d1baed9f59c7ae9c67205043204
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2b6c2d1e4c043c62936e9dac6caf21e199e31a345cf4845f2c7219b702089de4
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D202AF21E196C240FF52BB15A9137BDA684AF42BA8FC84637DD6D473D5DEBCA4018332
                                                                                                                                                                                                                              Function 00007FF7E19518F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 179 7ff7e19518f0-7ff7e195192b call 7ff7e1953f70 182 7ff7e1951bc1-7ff7e1951be5 call 7ff7e195b870 179->182 183 7ff7e1951931-7ff7e1951971 call 7ff7e19576a0 179->183 188 7ff7e1951bae-7ff7e1951bb1 call 7ff7e195f36c 183->188 189 7ff7e1951977-7ff7e1951987 call 7ff7e195f9f4 183->189 193 7ff7e1951bb6-7ff7e1951bbe 188->193 194 7ff7e1951989-7ff7e195199c call 7ff7e1952760 189->194 195 7ff7e19519a1-7ff7e19519bd call 7ff7e195f6bc 189->195 193->182 194->188 200 7ff7e19519d7-7ff7e19519ec call 7ff7e1964154 195->200 201 7ff7e19519bf-7ff7e19519d2 call 7ff7e1952760 195->201 206 7ff7e19519ee-7ff7e1951a01 call 7ff7e1952760 200->206 207 7ff7e1951a06-7ff7e1951a90 call 7ff7e1951bf0 * 2 call 7ff7e195f9f4 call 7ff7e1964170 200->207 201->188 206->188 217 7ff7e1951a95-7ff7e1951a9f 207->217 218 7ff7e1951ab9-7ff7e1951ad2 call 7ff7e195f6bc 217->218 219 7ff7e1951aa1-7ff7e1951ab4 call 7ff7e1952760 217->219 224 7ff7e1951aec-7ff7e1951b08 call 7ff7e195f430 218->224 225 7ff7e1951ad4-7ff7e1951ae7 call 7ff7e1952760 218->225 219->188 230 7ff7e1951b1b-7ff7e1951b29 224->230 231 7ff7e1951b0a-7ff7e1951b16 call 7ff7e19525f0 224->231 225->188 230->188 233 7ff7e1951b2f-7ff7e1951b3e 230->233 231->188 235 7ff7e1951b40-7ff7e1951b46 233->235 236 7ff7e1951b48-7ff7e1951b55 235->236 237 7ff7e1951b60-7ff7e1951b6f 235->237 238 7ff7e1951b71-7ff7e1951b7a 236->238 237->237 237->238 239 7ff7e1951b7c-7ff7e1951b7f 238->239 240 7ff7e1951b8f 238->240 239->240 241 7ff7e1951b81-7ff7e1951b84 239->241 242 7ff7e1951b91-7ff7e1951bac 240->242 241->240 243 7ff7e1951b86-7ff7e1951b89 241->243 242->188 242->235 243->240 244 7ff7e1951b8b-7ff7e1951b8d 243->244 244->242
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _fread_nolock$Message
                                                                                                                                                                                                                              • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                                              • API String ID: 677216364-3497178890
                                                                                                                                                                                                                              • Opcode ID: 42b37760e274584852153579fc07233a65d644a0a6902a26a705c376e90c4567
                                                                                                                                                                                                                              • Instruction ID: 44bf4c535bcc73cdb579c0cd0952e2bc95f57cfae02f27083a77e936273e6deb
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 42b37760e274584852153579fc07233a65d644a0a6902a26a705c376e90c4567
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 18718271A086C685EB20FB24E4623F9A3A1FF4478CF844037D98D57699EEBCE5458732
                                                                                                                                                                                                                              Function 00007FF7E19515C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 245 7ff7e19515c0-7ff7e19515d1 246 7ff7e19515f7-7ff7e1951611 call 7ff7e1953f70 245->246 247 7ff7e19515d3-7ff7e19515dc call 7ff7e1951050 245->247 254 7ff7e195163b-7ff7e1951655 call 7ff7e1953f70 246->254 255 7ff7e1951613-7ff7e195163a call 7ff7e1952760 246->255 252 7ff7e19515ee-7ff7e19515f6 247->252 253 7ff7e19515de-7ff7e19515e9 call 7ff7e19525f0 247->253 253->252 261 7ff7e1951657-7ff7e195166c call 7ff7e19525f0 254->261 262 7ff7e1951671-7ff7e1951688 call 7ff7e195f9f4 254->262 269 7ff7e19517c5-7ff7e19517c8 call 7ff7e195f36c 261->269 267 7ff7e19516ab-7ff7e19516af 262->267 268 7ff7e195168a-7ff7e19516a6 call 7ff7e1952760 262->268 271 7ff7e19516c9-7ff7e19516e9 call 7ff7e1964170 267->271 272 7ff7e19516b1-7ff7e19516bd call 7ff7e19511f0 267->272 278 7ff7e19517bd-7ff7e19517c0 call 7ff7e195f36c 268->278 276 7ff7e19517cd-7ff7e19517df 269->276 282 7ff7e19516eb-7ff7e1951707 call 7ff7e1952760 271->282 283 7ff7e195170c-7ff7e1951717 271->283 279 7ff7e19516c2-7ff7e19516c4 272->279 278->269 279->278 292 7ff7e19517b3-7ff7e19517b8 282->292 284 7ff7e195171d-7ff7e1951726 283->284 285 7ff7e19517a6-7ff7e19517ae call 7ff7e196415c 283->285 288 7ff7e1951730-7ff7e1951752 call 7ff7e195f6bc 284->288 285->292 294 7ff7e1951754-7ff7e195176c call 7ff7e195fdfc 288->294 295 7ff7e1951785-7ff7e195178c 288->295 292->278 300 7ff7e195176e-7ff7e1951771 294->300 301 7ff7e1951775-7ff7e1951783 294->301 297 7ff7e1951793-7ff7e195179c call 7ff7e1952760 295->297 304 7ff7e19517a1 297->304 300->288 303 7ff7e1951773 300->303 301->297 303->304 304->285
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                              • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                              • API String ID: 2030045667-1550345328
                                                                                                                                                                                                                              • Opcode ID: 754f997bbe8beabe0e1a92e5933405e1b23506d69a4620a5dee4fc319d246387
                                                                                                                                                                                                                              • Instruction ID: c1a0fe49d154390555c66b5035394daf2f68ef00e8ca9b45717a8c69e55d2094
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 754f997bbe8beabe0e1a92e5933405e1b23506d69a4620a5dee4fc319d246387
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF519D61B086C292EB10BB15E8623B9A3A1BF44B9CFC44133ED1D57695EFBCE5548332
                                                                                                                                                                                                                              Function 00007FF7E1957FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                              • String ID: CreateProcessW$Failed to create child process!
                                                                                                                                                                                                                              • API String ID: 2895956056-699529898
                                                                                                                                                                                                                              • Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
                                                                                                                                                                                                                              • Instruction ID: ddec0746df0a7bdc36ff7f92c8f963c0d1247236cc9704491beb785a20c868fc
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE411E31A087C181DB20AB64F4563AAB3A1FF85368F900336E6AE477D5DFBCD0448B21
                                                                                                                                                                                                                              Function 00007FF7E19511F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 553 7ff7e19511f0-7ff7e195124d call 7ff7e195b0a0 556 7ff7e1951277-7ff7e195128f call 7ff7e1964170 553->556 557 7ff7e195124f-7ff7e1951276 call 7ff7e19525f0 553->557 562 7ff7e19512ad-7ff7e19512bd call 7ff7e1964170 556->562 563 7ff7e1951291-7ff7e19512a8 call 7ff7e1952760 556->563 569 7ff7e19512db-7ff7e19512ed 562->569 570 7ff7e19512bf-7ff7e19512d6 call 7ff7e1952760 562->570 568 7ff7e1951409-7ff7e195141e call 7ff7e195ad80 call 7ff7e196415c * 2 563->568 585 7ff7e1951423-7ff7e195143d 568->585 572 7ff7e19512f0-7ff7e1951315 call 7ff7e195f6bc 569->572 570->568 579 7ff7e195131b-7ff7e1951325 call 7ff7e195f430 572->579 580 7ff7e1951401 572->580 579->580 586 7ff7e195132b-7ff7e1951337 579->586 580->568 587 7ff7e1951340-7ff7e1951368 call 7ff7e19594e0 586->587 590 7ff7e195136a-7ff7e195136d 587->590 591 7ff7e19513e6-7ff7e19513fc call 7ff7e19525f0 587->591 592 7ff7e195136f-7ff7e1951379 590->592 593 7ff7e19513e1 590->593 591->580 595 7ff7e195137b-7ff7e1951389 call 7ff7e195fdfc 592->595 596 7ff7e19513a4-7ff7e19513a7 592->596 593->591 602 7ff7e195138e-7ff7e1951391 595->602 597 7ff7e19513a9-7ff7e19513b7 call 7ff7e1979140 596->597 598 7ff7e19513ba-7ff7e19513bf 596->598 597->598 598->587 601 7ff7e19513c5-7ff7e19513c8 598->601 604 7ff7e19513dc-7ff7e19513df 601->604 605 7ff7e19513ca-7ff7e19513cd 601->605 606 7ff7e1951393-7ff7e195139d call 7ff7e195f430 602->606 607 7ff7e195139f-7ff7e19513a2 602->607 604->580 605->591 608 7ff7e19513cf-7ff7e19513d7 605->608 606->598 606->607 607->591 608->572
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                              • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                              • API String ID: 2030045667-2813020118
                                                                                                                                                                                                                              • Opcode ID: 9f7725012da1cc34fce5d0bfb3ee6aec36ae4ef04eadb8e7a4371b04415525bd
                                                                                                                                                                                                                              • Instruction ID: 83037d61c689596ee6f3910a4ba8afbd7dd6fcd48b3f1a06a132b16bb099b9a6
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9f7725012da1cc34fce5d0bfb3ee6aec36ae4ef04eadb8e7a4371b04415525bd
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E751E662A086C281E720BB11E4623BAA651BF8479CF840136DD4D57BD5EFBCE441C731
                                                                                                                                                                                                                              Function 00007FF7E196E020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF7E196E3BA,?,?,-00000018,00007FF7E196A063,?,?,?,00007FF7E1969F5A,?,?,?,00007FF7E196524E), ref: 00007FF7E196E19C
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF7E196E3BA,?,?,-00000018,00007FF7E196A063,?,?,?,00007FF7E1969F5A,?,?,?,00007FF7E196524E), ref: 00007FF7E196E1A8
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                                                                                                                              • Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
                                                                                                                                                                                                                              • Instruction ID: 0cd3a956997cc7d86d271fd46575e5a391f4615fdcd59e9f1d5706915ee5d974
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75410631B1968282FB12EB26AC117B6A391BF45B98F894137DD0D47784EEBCE405D332
                                                                                                                                                                                                                              Function 00007FF7E1957C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF7E1953834), ref: 00007FF7E1957CE4
                                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(?,?,FFFFFFFF,00007FF7E1953834), ref: 00007FF7E1957D2C
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1957E10: GetEnvironmentVariableW.KERNEL32(00007FF7E195365F), ref: 00007FF7E1957E47
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1957E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E1957E69
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1967548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E1967561
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E19526C0: MessageBoxW.USER32 ref: 00007FF7E1952736
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                                              • API String ID: 740614611-1339014028
                                                                                                                                                                                                                              • Opcode ID: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
                                                                                                                                                                                                                              • Instruction ID: 9301a35ace2f5559e4223cdbd2ea6bdb2fcdc5d62119233626a56cfd980e5949
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 74416611B096C281EB28FB61A9673F99291BF55788FC40033DD0E67796EEBCE5018372
                                                                                                                                                                                                                              Function 00007FF7E196AD6C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 727 7ff7e196ad6c-7ff7e196ad92 728 7ff7e196adad-7ff7e196adb1 727->728 729 7ff7e196ad94-7ff7e196ada8 call 7ff7e19643d4 call 7ff7e19643f4 727->729 731 7ff7e196b187-7ff7e196b193 call 7ff7e19643d4 call 7ff7e19643f4 728->731 732 7ff7e196adb7-7ff7e196adbe 728->732 747 7ff7e196b19e 729->747 749 7ff7e196b199 call 7ff7e1969bf0 731->749 732->731 734 7ff7e196adc4-7ff7e196adf2 732->734 734->731 737 7ff7e196adf8-7ff7e196adff 734->737 741 7ff7e196ae18-7ff7e196ae1b 737->741 742 7ff7e196ae01-7ff7e196ae13 call 7ff7e19643d4 call 7ff7e19643f4 737->742 745 7ff7e196b183-7ff7e196b185 741->745 746 7ff7e196ae21-7ff7e196ae27 741->746 742->749 750 7ff7e196b1a1-7ff7e196b1b8 745->750 746->745 751 7ff7e196ae2d-7ff7e196ae30 746->751 747->750 749->747 751->742 754 7ff7e196ae32-7ff7e196ae57 751->754 756 7ff7e196ae59-7ff7e196ae5b 754->756 757 7ff7e196ae8a-7ff7e196ae91 754->757 760 7ff7e196ae5d-7ff7e196ae64 756->760 761 7ff7e196ae82-7ff7e196ae88 756->761 758 7ff7e196ae66-7ff7e196ae7d call 7ff7e19643d4 call 7ff7e19643f4 call 7ff7e1969bf0 757->758 759 7ff7e196ae93-7ff7e196aebb call 7ff7e196c90c call 7ff7e1969c58 * 2 757->759 788 7ff7e196b010 758->788 790 7ff7e196aebd-7ff7e196aed3 call 7ff7e19643f4 call 7ff7e19643d4 759->790 791 7ff7e196aed8-7ff7e196af03 call 7ff7e196b594 759->791 760->758 760->761 762 7ff7e196af08-7ff7e196af1f 761->762 765 7ff7e196af9a-7ff7e196afa4 call 7ff7e1972c2c 762->765 766 7ff7e196af21-7ff7e196af29 762->766 779 7ff7e196b02e 765->779 780 7ff7e196afaa-7ff7e196afbf 765->780 766->765 769 7ff7e196af2b-7ff7e196af2d 766->769 769->765 773 7ff7e196af2f-7ff7e196af45 769->773 773->765 777 7ff7e196af47-7ff7e196af53 773->777 777->765 784 7ff7e196af55-7ff7e196af57 777->784 786 7ff7e196b033-7ff7e196b053 ReadFile 779->786 780->779 782 7ff7e196afc1-7ff7e196afd3 GetConsoleMode 780->782 782->779 787 7ff7e196afd5-7ff7e196afdd 782->787 784->765 789 7ff7e196af59-7ff7e196af71 784->789 792 7ff7e196b14d-7ff7e196b156 GetLastError 786->792 793 7ff7e196b059-7ff7e196b061 786->793 787->786 795 7ff7e196afdf-7ff7e196b001 ReadConsoleW 787->795 798 7ff7e196b013-7ff7e196b01d call 7ff7e1969c58 788->798 789->765 799 7ff7e196af73-7ff7e196af7f 789->799 790->788 791->762 796 7ff7e196b158-7ff7e196b16e call 7ff7e19643f4 call 7ff7e19643d4 792->796 797 7ff7e196b173-7ff7e196b176 792->797 793->792 801 7ff7e196b067 793->801 803 7ff7e196b003 GetLastError 795->803 804 7ff7e196b022-7ff7e196b02c 795->804 796->788 808 7ff7e196b17c-7ff7e196b17e 797->808 809 7ff7e196b009-7ff7e196b00b call 7ff7e1964368 797->809 798->750 799->765 807 7ff7e196af81-7ff7e196af83 799->807 811 7ff7e196b06e-7ff7e196b083 801->811 803->809 804->811 807->765 816 7ff7e196af85-7ff7e196af95 807->816 808->798 809->788 811->798 812 7ff7e196b085-7ff7e196b090 811->812 818 7ff7e196b0b7-7ff7e196b0bf 812->818 819 7ff7e196b092-7ff7e196b0ab call 7ff7e196a984 812->819 816->765 823 7ff7e196b13b-7ff7e196b148 call 7ff7e196a7c4 818->823 824 7ff7e196b0c1-7ff7e196b0d3 818->824 827 7ff7e196b0b0-7ff7e196b0b2 819->827 823->827 828 7ff7e196b12e-7ff7e196b136 824->828 829 7ff7e196b0d5 824->829 827->798 828->798 831 7ff7e196b0da-7ff7e196b0e1 829->831 832 7ff7e196b11d-7ff7e196b128 831->832 833 7ff7e196b0e3-7ff7e196b0e7 831->833 832->828 834 7ff7e196b0e9-7ff7e196b0f0 833->834 835 7ff7e196b103 833->835 834->835 836 7ff7e196b0f2-7ff7e196b0f6 834->836 837 7ff7e196b109-7ff7e196b119 835->837 836->835 838 7ff7e196b0f8-7ff7e196b101 836->838 837->831 839 7ff7e196b11b 837->839 838->837 839->828
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                              • Opcode ID: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
                                                                                                                                                                                                                              • Instruction ID: bcfa05b36a7d5a51b84d60f5ec58e2d839f6658ba8d5d206bb49ef91f38abc15
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D1C1D222A0C6C691E761BB5594023BDBB90FB91B88F950133DA4E07795EFFCE8558332
                                                                                                                                                                                                                              Function 00007FF7E1957B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 995526605-0
                                                                                                                                                                                                                              • Opcode ID: fa100e685baa98e829519164d8c7bae0263b828ebdd9095db38f9558f9492d32
                                                                                                                                                                                                                              • Instruction ID: 6f73a7fae911e77d652a784db79f0e4345e55ced2999bd66e95b2a1dbf67fad6
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fa100e685baa98e829519164d8c7bae0263b828ebdd9095db38f9558f9492d32
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8F216531E0CAC242EB14AB55E45532AE3A1FF857A8F900236DA6D43BD4DFBCD5448721
                                                                                                                                                                                                                              Function 00007FF7E19533E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,00007FF7E1953534), ref: 00007FF7E1953411
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E19529E0: GetLastError.KERNEL32(?,?,?,00007FF7E195342E,?,00007FF7E1953534), ref: 00007FF7E1952A14
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E19529E0: FormatMessageW.KERNEL32(?,?,?,00007FF7E195342E), ref: 00007FF7E1952A7D
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E19529E0: MessageBoxW.USER32 ref: 00007FF7E1952ACF
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message$ErrorFileFormatLastModuleName
                                                                                                                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                                              • API String ID: 517058245-2863816727
                                                                                                                                                                                                                              • Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
                                                                                                                                                                                                                              • Instruction ID: 6b22eca30e50bf0682178d15714a9952c8efac1b1be941f955d8ed576802277f
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C3218E61B185C291FB21BB25E8633BAA351BF4879CFC00133D65D965E5EEBCE2058732
                                                                                                                                                                                                                              Function 00007FF7E1958400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1957B50: GetCurrentProcess.KERNEL32 ref: 00007FF7E1957B70
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1957B50: OpenProcessToken.ADVAPI32 ref: 00007FF7E1957B83
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1957B50: GetTokenInformation.KERNELBASE ref: 00007FF7E1957BA8
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1957B50: GetLastError.KERNEL32 ref: 00007FF7E1957BB2
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1957B50: GetTokenInformation.KERNELBASE ref: 00007FF7E1957BF2
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1957B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7E1957C0E
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1957B50: CloseHandle.KERNEL32 ref: 00007FF7E1957C26
                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00007FF7E1953814), ref: 00007FF7E195848C
                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,00007FF7E1953814), ref: 00007FF7E1958495
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                                              • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                                              • API String ID: 6828938-1529539262
                                                                                                                                                                                                                              • Opcode ID: 00508f9f8b173662f129ea82402565ecad2bd7bdcd40e7a91b5badc9791cb352
                                                                                                                                                                                                                              • Instruction ID: f15b1b2e8f9d8198dd4765348ac9d0070e4dbdc71b6a0d99f53eb3784335b3dc
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 00508f9f8b173662f129ea82402565ecad2bd7bdcd40e7a91b5badc9791cb352
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AA213021A0868181E714BB51E4263E9A2A1FF84788FC44437EA4E63796DFBCD545C772
                                                                                                                                                                                                                              Function 00007FF7E1957530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(00000000,?,00007FF7E195324C,?,?,00007FF7E1953964), ref: 00007FF7E1957642
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CreateDirectory
                                                                                                                                                                                                                              • String ID: %.*s$%s%c$\
                                                                                                                                                                                                                              • API String ID: 4241100979-1685191245
                                                                                                                                                                                                                              • Opcode ID: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
                                                                                                                                                                                                                              • Instruction ID: c34d5b3cb5a91105b0ab103c3374ca6229728af7fb6e7b39d1183cc7cf6cd655
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F31EA21619AC145EB21AB15E4217AAA255FF44BE8FC04232EE6D537C9DF7CD3018731
                                                                                                                                                                                                                              Function 00007FF7E196C270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E196C25B), ref: 00007FF7E196C38C
                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E196C25B), ref: 00007FF7E196C417
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 953036326-0
                                                                                                                                                                                                                              • Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
                                                                                                                                                                                                                              • Instruction ID: 6a268c486a6244fe4fb085334f8e5263ebd1d8af9c0c96604283696861359125
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB91A262B086D185F750EB6594423BDABA0BB54B8CFD44136EE0E67A85DFBCD4418332
                                                                                                                                                                                                                              Function 00007FF7E196EC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4170891091-0
                                                                                                                                                                                                                              • Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
                                                                                                                                                                                                                              • Instruction ID: 982a150b0f0afb3b2ca7370a46173b35559c1f825e0c8911512c17e5987dd49a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 40510472F046968AFB14EF749D527BCA7A1AB1035CF900136DE1E52AE5DF7CA4028722
                                                                                                                                                                                                                              Function 00007FF7E1964A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2780335769-0
                                                                                                                                                                                                                              • Opcode ID: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
                                                                                                                                                                                                                              • Instruction ID: 78690435a435ba8adf42e299a89a544e00cf3f7e18ad9bf8bec35d7c2440b283
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE516E22E086818AFB14EFB1D4523BDA7A1FB58B9CF504536DE0947788DFBCD4818762
                                                                                                                                                                                                                              Function 00007FF7E1964938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1279662727-0
                                                                                                                                                                                                                              • Opcode ID: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
                                                                                                                                                                                                                              • Instruction ID: ea6bcc64b68ba7bdd415f463e8a277f4b5301a68a9c0f275e3f6cdcfb7e420de
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c9c3dc0ca6ff3025a18f37416ed5252826b5e2a6b8668c561ba6737191909872
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FC41A232D187C243E754ABA09512379A260FF957A8F509336E69C03AD5DFBCA1E08721
                                                                                                                                                                                                                              Function 00007FF7E195BF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3251591375-0
                                                                                                                                                                                                                              • Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
                                                                                                                                                                                                                              • Instruction ID: d7eb80584408552d1c47d91ea00ed75abf4cbfadb7153fca13317a88e7011dd3
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 51310A11A0C2C341FB55BB7494673B9A295AF4278CFC40037E90E676D3DEBDA8458233
                                                                                                                                                                                                                              Function 00007FF7E1968D48 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                                              • Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
                                                                                                                                                                                                                              • Instruction ID: 01c5bda099025f73cbe5c428395e8fd5e70d7ed003c8bfea5aa0e0d6f8307cb4
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 33D06710B1978686EB543B70986A37992116F68749F90143AD84B0A393DDBCA8894372
                                                                                                                                                                                                                              Function 00007FF7E195F45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                              • Opcode ID: bcfcf1faf55df9f9e23f958511fce33fc2a490ff62131b022dace26bbec7c8c2
                                                                                                                                                                                                                              • Instruction ID: dd868e1c55a6e915faa63a7a53600df8fd3fd6dbf382916c281278fb526072bc
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bcfcf1faf55df9f9e23f958511fce33fc2a490ff62131b022dace26bbec7c8c2
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C51F421B0A2C247EB24BE3594227BAA691FF44BBCF944636DD6D137D5CEBCD4018632
                                                                                                                                                                                                                              Function 00007FF7E196B444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2976181284-0
                                                                                                                                                                                                                              • Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
                                                                                                                                                                                                                              • Instruction ID: ff377f8687050fd9faf9d4124f19ce4c7447a43d50ff70d3991f3fa0b8e5ad9e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6311C462708AC181DB10AB25E945269A361BB44FF8F940332EE7E077E9DFBCD0508711
                                                                                                                                                                                                                              Function 00007FF7E1964C34 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E1964B49), ref: 00007FF7E1964C67
                                                                                                                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E1964B49), ref: 00007FF7E1964C7D
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1707611234-0
                                                                                                                                                                                                                              • Opcode ID: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
                                                                                                                                                                                                                              • Instruction ID: ecb24ecfd8d24b47e4a9f2974d7b12e52f8d677745cba330881b78006ed39f65
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5814b874014510fcf00941fef2b2171ed045486f006683dc2ae422325307d6da
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DF11EB3190C68281D7149B55E41227EF7A0FB41768F900237F6AD42AD8EFBCD010CB21
                                                                                                                                                                                                                              Function 00007FF7E1969C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(?,?,?,00007FF7E1972032,?,?,?,00007FF7E197206F,?,?,00000000,00007FF7E1972535,?,?,?,00007FF7E1972467), ref: 00007FF7E1969C6E
                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7E1972032,?,?,?,00007FF7E197206F,?,?,00000000,00007FF7E1972535,?,?,?,00007FF7E1972467), ref: 00007FF7E1969C78
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                              • Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
                                                                                                                                                                                                                              • Instruction ID: 7d01f4d0697ed326891b7fb26bd0dcfd68b71d3bd00bb273babbed8a2680cd49
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E7E08C50F096C242FF087BF2A95737A9291AF98748BC04032DD0E87251EEBC68858333
                                                                                                                                                                                                                              Function 00007FF7E1969E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(?,?,?,00007FF7E1969CE5,?,?,00000000,00007FF7E1969D9A), ref: 00007FF7E1969ED6
                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7E1969CE5,?,?,00000000,00007FF7E1969D9A), ref: 00007FF7E1969EE0
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 918212764-0
                                                                                                                                                                                                                              • Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
                                                                                                                                                                                                                              • Instruction ID: 8d9f89b05e262de52e52f7a183d8765a5b4125fe5465d43bc7ed8ecdec3cb0f2
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0F219221B1C6C241EF55B7A4AA5237D92916F847A8F884237D92F476D5CEFCE4408333
                                                                                                                                                                                                                              Function 00007FF7E196B1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                              • Opcode ID: 164a9401b0bfd199dc8034d016670759b34e81a86d5a64e83628a5f98765227c
                                                                                                                                                                                                                              • Instruction ID: d32d8d6f63724c8d9dd62aba9dc9785866744a4eab6f19e4e66bc9d1b2c2931a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 164a9401b0bfd199dc8034d016670759b34e81a86d5a64e83628a5f98765227c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8741C732A0828187EB24AB15A55237DB3A0FB65789F940132DA9F436D1DFBCE502C772
                                                                                                                                                                                                                              Function 00007FF7E19576A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _fread_nolock
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 840049012-0
                                                                                                                                                                                                                              • Opcode ID: c1993e3b70cfaf21c0732b701e3ca0e559f70d037230016266d35f3214609ed1
                                                                                                                                                                                                                              • Instruction ID: 0b12aece2018c6cb4588b281db3743362d57730976fec67b93260bb778a6afc4
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c1993e3b70cfaf21c0732b701e3ca0e559f70d037230016266d35f3214609ed1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 07219121B0869146FB14BA16A9263BAE651BF45BD8FC84432DD0D17782DEBDE141C231
                                                                                                                                                                                                                              Function 00007FF7E196AC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                              • Opcode ID: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
                                                                                                                                                                                                                              • Instruction ID: 60bf591344707ee39d7cb6ea721d6664e22e116fcf460bd4f9616437d2fde49c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E5318E21E186C286E751BB55994237DA650AB60BA9F914137DA2D0B3D2CFFCE8418732
                                                                                                                                                                                                                              Function 00007FF7E1968C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3947729631-0
                                                                                                                                                                                                                              • Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
                                                                                                                                                                                                                              • Instruction ID: 7e701f261dbb8e9076a91808a38d369e22e9d9a16a36c98ef89066ee6927d6f6
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D2218B32E157858EEB24AF64D4463AC73A0FB0431CF84063AD62D06AD9EFBCD484CB61
                                                                                                                                                                                                                              Function 00007FF7E19652A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                              • Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
                                                                                                                                                                                                                              • Instruction ID: d117cd2cbed8da40d4f032ac5b89bcf9458be3aa20078c98697c34d8e56de213
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5A116271A1C6C286FB60BF51950237EE2A4BF55BC8F854032EA4D57A96CFBCD4408772
                                                                                                                                                                                                                              Function 00007FF7E1975664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                              • Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
                                                                                                                                                                                                                              • Instruction ID: fb98052eece832244946d42f7dc53da06d69588f968311a7ec839a17ce6001d5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1521D772A08AC186EBA1AF18E441379F2A0EF94B98F944235D65D476E9DF7CD800CB11
                                                                                                                                                                                                                              Function 00007FF7E195F6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                              • Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
                                                                                                                                                                                                                              • Instruction ID: abe9d3667467ffc2486a650ab6489478c15d567b90b3d9f2af2d582d1eb60ed5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0B01C821A087C241EB04FF5659022A9E695BF55FF4F884632DE5C53BD6DFBCD5028321
                                                                                                                                                                                                                              Function 00007FF7E196720C Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                              • Opcode ID: bb049028caba5e04dba667320418798f18563eb801bd7df1d5910388d10efff1
                                                                                                                                                                                                                              • Instruction ID: 9538dd46ac6f3b5aa34d5ce19b5dd5485546f6a2c2d6d5c653c60ed431f05219
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bb049028caba5e04dba667320418798f18563eb801bd7df1d5910388d10efff1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 80015B20E196C241FFA8BB6566433799294AF457ACFC40537F95E426C6DFBCA4408233
                                                                                                                                                                                                                              Function 00007FF7E1967548 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                              • Opcode ID: c51c900cc97cfaa1f2463de7ded10a88eb35566439d91f89b12c497efef6b613
                                                                                                                                                                                                                              • Instruction ID: a4a880fe4764744fad2e2f45ace0bbb61b4a009638d5cfaede2025d4adc22eaf
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c51c900cc97cfaa1f2463de7ded10a88eb35566439d91f89b12c497efef6b613
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B8E0EC90E082C786FB587AF84AC377991109F64348FC04072D90A06283DEBC78449633
                                                                                                                                                                                                                              Function 00007FF7E196DEA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF7E196A63A,?,?,?,00007FF7E19643FD,?,?,?,?,00007FF7E196979A), ref: 00007FF7E196DEFD
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                              • Opcode ID: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
                                                                                                                                                                                                                              • Instruction ID: de802c4128278d9dd9ab5b2a9f69352b6c47d44fa3251aff310a10effeace97d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a50505f3dedbf875c6adc223253d20fad35851e197ada73c0c4444ee90b671f1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7CF04950B192C780FF55766699633B592D06F98B88FC84032D95E87281EEBCA4818232
                                                                                                                                                                                                                              Function 00007FF7E196C90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,?,00007FF7E195FFB0,?,?,?,00007FF7E196161A,?,?,?,?,?,00007FF7E1962E09), ref: 00007FF7E196C94A
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                              • Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
                                                                                                                                                                                                                              • Instruction ID: d192ed3d8562fdf71800c954579160982e579b004d60238dcd9eca5ff0f6674a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C6F05821B192C784FF5476B2595337992805F88BA8FC84232BC2E862C1DEFCA4818233

                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                              Function 00007FF7E1956EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                                              • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                              • API String ID: 190572456-3427451314
                                                                                                                                                                                                                              • Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
                                                                                                                                                                                                                              • Instruction ID: 979f4a5cea63d0492341d39b77d2e5402175611a22d44e2f1a1823d3e0f41d7c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9AE17864909BC390FB59BB19A8563B4A3A5BF0475CFC41037C85E22264EFBCB5589332
                                                                                                                                                                                                                              Function 00007FF7E19733BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                              • API String ID: 808467561-2761157908
                                                                                                                                                                                                                              • Opcode ID: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
                                                                                                                                                                                                                              • Instruction ID: 552f704c1e44354614b507dad52f021fdf9b94b431367549caa924ea4f773eab
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 91B21372F182C28BE7259E64D4427FDB7A1FF5478CF801136DA0E57A85DBB8AA00CB51
                                                                                                                                                                                                                              Function 00007FF7E1959FCD Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                                              • API String ID: 0-2665694366
                                                                                                                                                                                                                              • Opcode ID: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
                                                                                                                                                                                                                              • Instruction ID: 2bea354e49de6536a75db9bb1d4398e79a6498437cf10c003d87190c0a0c4e03
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E525872A146E54BE7949F14C469B7E7BEDFB84348F81413AE64A97780DB7CE800CB21
                                                                                                                                                                                                                              Function 00007FF7E195C44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                                                              • Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
                                                                                                                                                                                                                              • Instruction ID: f3c9904d5fa499917255e392ff8a4a4e7fcbd3c1e445e1aa92a31d828dc8e6d4
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E2316D72609BC186EB60AF60E8917EEB364FB84748F84403ADA4E57B94DF78C548C721
                                                                                                                                                                                                                              Function 00007FF7E19529E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message$ErrorFormatLast
                                                                                                                                                                                                                              • String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
                                                                                                                                                                                                                              • API String ID: 3971115935-1149178304
                                                                                                                                                                                                                              • Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
                                                                                                                                                                                                                              • Instruction ID: 70ec3fef377d1816347c9c5032d60891c56d73056549e2df1f779442039ec0fe
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BB212372618AC582E720AB10F4517EAB364FB88788F800137EACD53A98DFBCD5468751
                                                                                                                                                                                                                              Function 00007FF7E1969924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1239891234-0
                                                                                                                                                                                                                              • Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
                                                                                                                                                                                                                              • Instruction ID: c92382fb32d05f7c5d4361a077d8676e405890c0c9153ce9a5ecbfadd4df2962
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2F316232618BC186DB60DF25E8413AEB3A4FB88758F940136EA9E47B95DF7CC145CB21
                                                                                                                                                                                                                              Function 00007FF7E1970B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2227656907-0
                                                                                                                                                                                                                              • Opcode ID: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
                                                                                                                                                                                                                              • Instruction ID: 75205413de44642cfdf3d1e0bd59de2dffd0b8137baac7ebd17d92aef42d62b4
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 81B19661B187D241EB60AB2194167BDE391EF45BD8F885133E95E07BC5DEBCE441C322
                                                                                                                                                                                                                              Function 00007FF7E195C330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2933794660-0
                                                                                                                                                                                                                              • Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
                                                                                                                                                                                                                              • Instruction ID: 3d906d7b91a75ca50b615f1bcfc7c36cfb99d583f09e7360f043c0b6caedc130
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E7115E22B15F458AEB00DF60E8553B873A4FB5975CF840E32DA2D46BA4DFBCD1548351
                                                                                                                                                                                                                              Function 00007FF7E1972F20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memcpy_s
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1502251526-0
                                                                                                                                                                                                                              • Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
                                                                                                                                                                                                                              • Instruction ID: bbc0797a97ff10aebfa8243dc146e064098bf4dac9b20c1267322330f4484022
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B3C1D272B182C687EB349F19A04576AF7A1FB84B88F848136DB4A47744DF7DEA11CB40
                                                                                                                                                                                                                              Function 00007FF7E195979B Relevance: 4.1, Strings: 3, Instructions: 397COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                                              • API String ID: 0-1127688429
                                                                                                                                                                                                                              • Opcode ID: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
                                                                                                                                                                                                                              • Instruction ID: 7745938b9ff312a2d84b9b45dac371a02681d0acef3a4be151a0912234a31d8b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CEF1C572A183C54BF795AB15C0A9B3EBAADFF44748F854136DA4E27390CBB8E440C761
                                                                                                                                                                                                                              Function 00007FF7E1978A38 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 15204871-0
                                                                                                                                                                                                                              • Opcode ID: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
                                                                                                                                                                                                                              • Instruction ID: dd5d924576aba2adc442045aa671ea6e74c7e105e49f2665b61a147a06ce5484
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E9B16D73A04B898BE715DF29C4463687BA0FB84B4CF598822DB5D837A4CB7DD891C711
                                                                                                                                                                                                                              Function 00007FF7E1962CC4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: $
                                                                                                                                                                                                                              • API String ID: 0-227171996
                                                                                                                                                                                                                              • Opcode ID: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
                                                                                                                                                                                                                              • Instruction ID: 0fafa944626375b45c9642ccb470c3d3a177b906ae4bc09204251416ae951351
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 42E1D532A0868281EB68AF25C15223DB3A0FF55B4CFA44137DE4E07694DFB9E951C772
                                                                                                                                                                                                                              Function 00007FF7E19595FB Relevance: 2.7, Strings: 2, Instructions: 218COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                                              • API String ID: 0-900081337
                                                                                                                                                                                                                              • Opcode ID: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
                                                                                                                                                                                                                              • Instruction ID: 187ee5da77e25ccd27472a6515aa2620f0fc38e46d27277247606f2bf49fe933
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3E91B772A182C64BF7A49F14D469B3E7AADFB44348F41413ADA4B56780CB7CE540CB25
                                                                                                                                                                                                                              Function 00007FF7E196D200 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: e+000$gfff
                                                                                                                                                                                                                              • API String ID: 0-3030954782
                                                                                                                                                                                                                              • Opcode ID: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
                                                                                                                                                                                                                              • Instruction ID: 28344fa96b972c0f3bed4d96cc830d00a7487959c5de900fae6a3e4fc98bcc8e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8D515B22B1C2C546E7249E359802769E7D1F744B98F889233CBA847AC5CFBDD444C722
                                                                                                                                                                                                                              Function 00007FF7E196CD6C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: gfffffff
                                                                                                                                                                                                                              • API String ID: 0-1523873471
                                                                                                                                                                                                                              • Opcode ID: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
                                                                                                                                                                                                                              • Instruction ID: 72112532194f46592b2b2cb55a92a548018ca1edd4c3c00a5cd12001fd49c4e6
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DBA14762B087C586EB21DF25A4017AEBB90EB54BC8F848133EE8D47791DE7DE501C322
                                                                                                                                                                                                                              Function 00007FF7E1967AAC Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID: TMP
                                                                                                                                                                                                                              • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                              • Opcode ID: 839a1a806d2b08c8b9ade1ed9786cb9cb8429efd2ac68b7f8e7a62dba0c63b20
                                                                                                                                                                                                                              • Instruction ID: 9ea4ff77dc265f58bcfd2c4d172afe3db575e47e7a7ebfa6e7cb1a7cbe1735df
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 839a1a806d2b08c8b9ade1ed9786cb9cb8429efd2ac68b7f8e7a62dba0c63b20
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9B519311F086C241FB58BA3659137BAD291AF91BCCF984436DE0F47795EEBCE4518232
                                                                                                                                                                                                                              Function 00007FF7E1972790 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: HeapProcess
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 54951025-0
                                                                                                                                                                                                                              • Opcode ID: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
                                                                                                                                                                                                                              • Instruction ID: 3d9e9ab54bf9b5388254dd406a3851a90881d23afbb7f2413abb15eafb499bc6
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D8B09260E07AC6C2EB083B15AC8731863A87F88704FE4807AC40D41320DEBC20A64722
                                                                                                                                                                                                                              Function 00007FF7E19628C0 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
                                                                                                                                                                                                                              • Instruction ID: f7856e7d619d9ba6a013d5e5f2e15aaddca9de1fed2294fa3ade28f4f61f8ce2
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0CD19F32A0868285EB68AF25855237DB7A0EB45B8CFA44277CE0D076D4DFBDD841D372
                                                                                                                                                                                                                              Function 00007FF7E1958B20 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
                                                                                                                                                                                                                              • Instruction ID: 2ca13d38270f329da1bf2bbc8d5253d20d8d64616a5366300deaadca0e59678b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A3C1BF722142F14FD289FB29E46957A73E1F79830DBD4402BEB8747B85CA3CA414D7A1
                                                                                                                                                                                                                              Function 00007FF7E1961F30 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
                                                                                                                                                                                                                              • Instruction ID: 48afb12ef99c5c4e30cb3bb0d7105bb0c1098e60c26e3560bf9e5249eb1a1e5a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17B18B72A0868685E7699F29C05623CBBA0F749B8CFA50176CB4E47395CFB9E441C732
                                                                                                                                                                                                                              Function 00007FF7E196D880 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
                                                                                                                                                                                                                              • Instruction ID: c5ecea2cd9912669de64b3d547a64ea79aec506a4efd89e861914acabbdd95b9
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4081D472A0C7C146E774DF29944237AA6D1FB89798F944236DAED47B89CF7CD4008B22
                                                                                                                                                                                                                              Function 00007FF7E1975728 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                              • Opcode ID: d2b2a23e656420a48cffdcfc29ff0550bdd13d7615b538a3eaf25f4462ec28d4
                                                                                                                                                                                                                              • Instruction ID: 9edcb5c55cb348917f8a9295f9897076fcedba30363b10a9d090a5d2ae0d5781
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d2b2a23e656420a48cffdcfc29ff0550bdd13d7615b538a3eaf25f4462ec28d4
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C561F9B2F0C2C246F7A4AA28841277DE681AF81778FD4463BD65D466D4DEFDE8008723
                                                                                                                                                                                                                              Function 00007FF7E1961484 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                              • Instruction ID: b8b2463e3600848a3f62a22127edecf6bdc266253a144a128c6480741227bacf
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92518776A1869186E7249B29C046338B3A0EB95F5CF684132CE4E577A4CF7AEC43C761
                                                                                                                                                                                                                              Function 00007FF7E1960C64 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                              • Instruction ID: a68391590e5ed93c787003ed98188ff3bf45377e7e0805246c0d5e5ce74fe71e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F951A572A18791C6E7249B29C09133C77A0EB54B6CFA84232CE4D07799CB7AEC43C761
                                                                                                                                                                                                                              Function 00007FF7E1961074 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                              • Instruction ID: 62204286db623e2ed4b5a40c1690aa8e40c909a6b0e7eca9d53feb4c59300eca
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44518376A186D1C6EB249B29C046338B3A0FB85F6CF654132CE4D57794CBBAE843C761
                                                                                                                                                                                                                              Function 00007FF7E1961280 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                              • Instruction ID: 10a0875f81384b431814805d87d0ddc6d60f16f15150dbdd20bc651b74a97c5e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7E51A372A186D186E7249B29C04273CB7A1EB85F5CFA44132CE4D57798CFBAE842C771
                                                                                                                                                                                                                              Function 00007FF7E1960A60 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                              • Instruction ID: d03aa9e49233ad111c26e896e1276a020faaaca567ed6b9c1e608f784035363e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78519436A18691C6E7249F29C08533CB7A1EB44B5CF688132CE4D17794DBBAE843C761
                                                                                                                                                                                                                              Function 00007FF7E1960E70 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                              • Instruction ID: e4d3eeb9f3d1ff0913379cf8f697a9138524b8bcf0a78faf56a6f40d73f68dcf
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF51C436A18AD1C5EB259B29C08133CB7A0EB44F5CFA84032CE4D57795CBBAEC42C761
                                                                                                                                                                                                                              Function 00007FF7E1965040 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                              • Instruction ID: 3ca10b203bd006c2d68744abb2e9932c8e411e6620476ccd42f1b43052367a49
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9041D7F2D4D7CA85FB55991805117B4A680BF12BE8FE913B2CD9D133C2CD6DE9868132
                                                                                                                                                                                                                              Function 00007FF7E19691B0 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                              • Opcode ID: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
                                                                                                                                                                                                                              • Instruction ID: 589aac768ea2d9d09f0d17b1a3775e3fc0665877d0153667f72f460936015c67
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0A410862714A9446EF04DF2AD915669F391BB48FD8B499433DE0E97B58DE7CC0428311
                                                                                                                                                                                                                              Function 00007FF7E19673F4 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 4baa1918ae36fbaba1f0c4c13332a4bc8c2fe618b431c1ec6b7f8f21172b3378
                                                                                                                                                                                                                              • Instruction ID: 6158ef2ed4ac3492047eaee018a446db4dac71780cc160ee77a7a83ec72732ed
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4baa1918ae36fbaba1f0c4c13332a4bc8c2fe618b431c1ec6b7f8f21172b3378
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 96312832718BC241E724AF26644223EAAD5AF84BD4F54423AEE4E53BD5DFBCD0014721
                                                                                                                                                                                                                              Function 00007FF7E1978880 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
                                                                                                                                                                                                                              • Instruction ID: a312c3b64b5704cb838b0a5456d6be5d5f64c4542ae02d4f82250e838dd7b50c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CBF044B16182958EEB94AF2DA40362A77D4F708384F80803AE58983A04D67D90508F15
                                                                                                                                                                                                                              Function 00007FF7E195C62C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
                                                                                                                                                                                                                              • Instruction ID: 9083c737d003e32c4498448cf9d626bff6ac3213ffd2e5788301b14941b39df6
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A6A0012191A8A6E0E748AB04E8A2225A224BB60318BC01032D00E520A09FBCA500C332
                                                                                                                                                                                                                              Function 00007FF7E19550B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7E1955C57,?,00007FF7E195308E), ref: 00007FF7E19550C0
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7E1955C57,?,00007FF7E195308E), ref: 00007FF7E1955101
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7E1955C57,?,00007FF7E195308E), ref: 00007FF7E1955126
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7E1955C57,?,00007FF7E195308E), ref: 00007FF7E195514B
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7E1955C57,?,00007FF7E195308E), ref: 00007FF7E1955173
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7E1955C57,?,00007FF7E195308E), ref: 00007FF7E195519B
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7E1955C57,?,00007FF7E195308E), ref: 00007FF7E19551C3
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7E1955C57,?,00007FF7E195308E), ref: 00007FF7E19551EB
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,00007FF7E1955C57,?,00007FF7E195308E), ref: 00007FF7E1955213
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                                              • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                              • API String ID: 190572456-2007157414
                                                                                                                                                                                                                              • Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
                                                                                                                                                                                                                              • Instruction ID: def4cf184b199730b8bc398c2f3b03df5532ad1e78bcba788b9dd05ba068c4ed
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 361276A490DBC391FB55BB58A8663B4A2A4BF0475DBD41437C80E22265EFFCB5488373
                                                                                                                                                                                                                              Function 00007FF7E19577D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E19586B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7E1953FA4,00000000,00007FF7E1951925), ref: 00007FF7E19586E9
                                                                                                                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(?,00007FF7E1957C97,?,?,FFFFFFFF,00007FF7E1953834), ref: 00007FF7E195782C
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E19526C0: MessageBoxW.USER32 ref: 00007FF7E1952736
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                              • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                                              • API String ID: 1662231829-930877121
                                                                                                                                                                                                                              • Opcode ID: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
                                                                                                                                                                                                                              • Instruction ID: 25093efd449715d74eb5b96ea5a4a5db4eb52ac02b3580b89b52fb59edb20c84
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE418421A1D6C281FB54BB25D8637B9E2A1BF4478CFC44433D64E63695EEBCE1048772
                                                                                                                                                                                                                              Function 00007FF7E19520F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                              • String ID: P%
                                                                                                                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                              • Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
                                                                                                                                                                                                                              • Instruction ID: 6c412fc1253bec8344bde9e088bd3a32ebb6c6a42d0a211c10b5412cc67325f4
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2F51E626608BA186D7249F22E4182BAF7A1FB98B65F404136EBDF43684DF7CD045CB20
                                                                                                                                                                                                                              Function 00007FF7E19655A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID: -$:$f$p$p
                                                                                                                                                                                                                              • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                              • Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
                                                                                                                                                                                                                              • Instruction ID: 53505c81617077bee863ef12995c8a5ec13e5025e42b66ac2664cd527acddbb2
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 451290B1E082C386FB24BA25D156379F651FB40798FD44137D689466C4DBBCE980CB36
                                                                                                                                                                                                                              Function 00007FF7E19602E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID: f$f$p$p$f
                                                                                                                                                                                                                              • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                              • Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
                                                                                                                                                                                                                              • Instruction ID: 74ebb8b23b0bba5d8693a3d3ec67b2e45f9b8853fffcd6ef76a0dea31a706521
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5A127131A0C1C3C6FB24BA14A49677DA662FB80758FDC4133D699466C4DBBDE8808B72
                                                                                                                                                                                                                              Function 00007FF7E1951050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                              • API String ID: 2030045667-3659356012
                                                                                                                                                                                                                              • Opcode ID: 830cda54f34893dfd7acd2d12a0e6010bb90b077f2c85e6270a74ea02814229d
                                                                                                                                                                                                                              • Instruction ID: 0cd16c61879b67850c95339490138839e8d2242539656f3afcc6d122bd3a8f7e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 830cda54f34893dfd7acd2d12a0e6010bb90b077f2c85e6270a74ea02814229d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 70416E21B086C286EB14BB52A8627B6E791BF44BCCF844033DD5E57795EEBCE4058332
                                                                                                                                                                                                                              Function 00007FF7E1951440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                              • API String ID: 2030045667-3659356012
                                                                                                                                                                                                                              • Opcode ID: 9a51ea836aee389e1e3ce3bab24b75ba1e10f8fd3983d3ea25fccc09339c6a2b
                                                                                                                                                                                                                              • Instruction ID: 970414f0a8706c26a382a8c9097b3d99ee78a41bc7950d669384a67611ea7a45
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9a51ea836aee389e1e3ce3bab24b75ba1e10f8fd3983d3ea25fccc09339c6a2b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F0417321B086C286EB20BB55E4627B5E351FF447DCF884033DE4E17A55EEBCE5428722
                                                                                                                                                                                                                              Function 00007FF7E195DD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                                                                                                                              • Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
                                                                                                                                                                                                                              • Instruction ID: 0081289ffd298249b9900838ac87f96c0cdf711cd2d3e9b97f971dbde3dd4351
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8CD18032A0878186EB20AB75D4523ADB7A0FB4578CF900136EE4D67B95CF79E484C732
                                                                                                                                                                                                                              Function 00007FF7E195CFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7E195D29A,?,?,?,00007FF7E195CF8C,?,?,?,00007FF7E195CB89), ref: 00007FF7E195D06D
                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7E195D29A,?,?,?,00007FF7E195CF8C,?,?,?,00007FF7E195CB89), ref: 00007FF7E195D07B
                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF7E195D29A,?,?,?,00007FF7E195CF8C,?,?,?,00007FF7E195CB89), ref: 00007FF7E195D0A5
                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF7E195D29A,?,?,?,00007FF7E195CF8C,?,?,?,00007FF7E195CB89), ref: 00007FF7E195D113
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF7E195D29A,?,?,?,00007FF7E195CF8C,?,?,?,00007FF7E195CB89), ref: 00007FF7E195D11F
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                              • Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
                                                                                                                                                                                                                              • Instruction ID: c2acfc8f4c52e05a506c6bc4654f78c564f86ade503a64a1d7bf76f5f37bb4ac
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB31B621A1A6C2C1EF15BB22A412779A3D4BF44BA8F990537DD1D17344EFBCE4428332
                                                                                                                                                                                                                              Function 00007FF7E196A460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                              • Opcode ID: 55a13e5d0c2be300fd0aa5feb7cab341fb5be024435351ef1c8ee5a0da484fed
                                                                                                                                                                                                                              • Instruction ID: 3adb7893158297fa2b457a5e8f353d5f265e8d802599a81bd9cf24c19b967288
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 55a13e5d0c2be300fd0aa5feb7cab341fb5be024435351ef1c8ee5a0da484fed
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 15213E20F082C242FB54B3315997779E1825F497A8F944636D93E0EAD6DEBCA4014737
                                                                                                                                                                                                                              Function 00007FF7E197707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                              • String ID: CONOUT$
                                                                                                                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                              • Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
                                                                                                                                                                                                                              • Instruction ID: 7a5d6334b36b186d0b754f1db2b1315c62333a9ab6cd5d2f86f48d9e0e7fe5d1
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5811B921B18B8186E7509B12F85A325E3A0FF58FE8F800235DA1E47794DFBCD404C751
                                                                                                                                                                                                                              Function 00007FF7E19581F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,00000000,?,00007FF7E19539F2), ref: 00007FF7E195821D
                                                                                                                                                                                                                              • K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF7E19539F2), ref: 00007FF7E195827A
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E19586B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7E1953FA4,00000000,00007FF7E1951925), ref: 00007FF7E19586E9
                                                                                                                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7E19539F2), ref: 00007FF7E1958305
                                                                                                                                                                                                                              • K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7E19539F2), ref: 00007FF7E1958364
                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,00000000,?,00007FF7E19539F2), ref: 00007FF7E1958375
                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,00000000,?,00007FF7E19539F2), ref: 00007FF7E195838A
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3462794448-0
                                                                                                                                                                                                                              • Opcode ID: 9b5c0b85d41d77bb9b541fba6b9840375d9a6616c292d566ae331ce4538faf90
                                                                                                                                                                                                                              • Instruction ID: 8912710325c16acde2a8ddc9cdb42cb8b1156d3a7e04bc93a66b4096823404dc
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9b5c0b85d41d77bb9b541fba6b9840375d9a6616c292d566ae331ce4538faf90
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36419262A196C281EB30AB12B4123BAA394FF84BC8F844136DF9D67796DE7CD445C721
                                                                                                                                                                                                                              Function 00007FF7E196A5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF7E19643FD,?,?,?,?,00007FF7E196979A,?,?,?,?,00007FF7E196649F), ref: 00007FF7E196A5E7
                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7E19643FD,?,?,?,?,00007FF7E196979A,?,?,?,?,00007FF7E196649F), ref: 00007FF7E196A61D
                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7E19643FD,?,?,?,?,00007FF7E196979A,?,?,?,?,00007FF7E196649F), ref: 00007FF7E196A64A
                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7E19643FD,?,?,?,?,00007FF7E196979A,?,?,?,?,00007FF7E196649F), ref: 00007FF7E196A65B
                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7E19643FD,?,?,?,?,00007FF7E196979A,?,?,?,?,00007FF7E196649F), ref: 00007FF7E196A66C
                                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,?,00007FF7E19643FD,?,?,?,?,00007FF7E196979A,?,?,?,?,00007FF7E196649F), ref: 00007FF7E196A687
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                              • Opcode ID: 5b7c94c1c225e14586273ae0994f3fea44242cff202284b06bfee03021f35fa8
                                                                                                                                                                                                                              • Instruction ID: 05aae242012eadf79c21305c499f81f30fcf909c663efe685d30fd954bd0d702
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5b7c94c1c225e14586273ae0994f3fea44242cff202284b06bfee03021f35fa8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 43112920E082C242FB54B7355657779E1825F887B8F844736D83E0AAD6EEBCA8014737
                                                                                                                                                                                                                              Function 00007FF7E1952300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                                                                                                                              • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                              • Opcode ID: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
                                                                                                                                                                                                                              • Instruction ID: 100c0857de919368c4827fd8bf1303dd80916db1b0b0cc595df8e2dc620b31a2
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A5316672A096C285EB24EF61E8563F9A360FF49788F840136EA4E47B59DF7CD104C721
                                                                                                                                                                                                                              Function 00007FF7E1952760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                              • String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
                                                                                                                                                                                                                              • API String ID: 1878133881-640379615
                                                                                                                                                                                                                              • Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
                                                                                                                                                                                                                              • Instruction ID: 4516477d9a57e8c49adc7a2b578e9e457de22280f08808256daafafcf4df7f8f
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FB216272628AC581E720AB50F4527EAA364FF8478CF804037EB8D13699DFBCD645C761
                                                                                                                                                                                                                              Function 00007FF7E1968DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                              • Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
                                                                                                                                                                                                                              • Instruction ID: f2383c924ecbf63b8a865a2bb7f12ec921375e654529082757c18ae87b5f54ec
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63F09661B1978281EF10AB24E85A3799360BF95BA9FD40637C96E465F4CFBCD089C331
                                                                                                                                                                                                                              Function 00007FF7E1978678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _set_statfp
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1156100317-0
                                                                                                                                                                                                                              • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                              • Instruction ID: 99765370b5082d96018428b2c239cc901ed951f6575a59acc254df1205d43cf5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 02118F32E68A8311F7543128D457375D1406F5437CFA50A36E96F066DA9EBCA8D18332
                                                                                                                                                                                                                              Function 00007FF7E196A6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF7E19698B3,?,?,00000000,00007FF7E1969B4E,?,?,?,?,?,00007FF7E1969ADA), ref: 00007FF7E196A6BF
                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7E19698B3,?,?,00000000,00007FF7E1969B4E,?,?,?,?,?,00007FF7E1969ADA), ref: 00007FF7E196A6DE
                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7E19698B3,?,?,00000000,00007FF7E1969B4E,?,?,?,?,?,00007FF7E1969ADA), ref: 00007FF7E196A706
                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7E19698B3,?,?,00000000,00007FF7E1969B4E,?,?,?,?,?,00007FF7E1969ADA), ref: 00007FF7E196A717
                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF7E19698B3,?,?,00000000,00007FF7E1969B4E,?,?,?,?,?,00007FF7E1969ADA), ref: 00007FF7E196A728
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                              • Opcode ID: 313936804f2539caa5b411e3780e1aa067584e6fc9dd7d8d0a30b7f4ad6b7a29
                                                                                                                                                                                                                              • Instruction ID: 2c7858f50e5dbe473e7a71b2c1e24d39006b2679398096c12aa91aef3d9c9ff5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 313936804f2539caa5b411e3780e1aa067584e6fc9dd7d8d0a30b7f4ad6b7a29
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 05112E60F082C241FB54B3355553779E1915F983A8F844336D83E0E6D6EEBCB8014637
                                                                                                                                                                                                                              Function 00007FF7E196A534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                              • Opcode ID: 8dbaaab3785cb5cbfef991dcb4b39f74944edf537148ee7de4100f4564720b13
                                                                                                                                                                                                                              • Instruction ID: 1881151fb2ea4e1c23842b2bc9f76a58f27e98d8282569758c5576e4b32ddbcd
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8dbaaab3785cb5cbfef991dcb4b39f74944edf537148ee7de4100f4564720b13
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DB11F560E0828746FB58B23544637BDA2814F49368F884737D93E0E6D2EEBCB4014237
                                                                                                                                                                                                                              Function 00007FF7E19652B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID: verbose
                                                                                                                                                                                                                              • API String ID: 3215553584-579935070
                                                                                                                                                                                                                              • Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
                                                                                                                                                                                                                              • Instruction ID: 85f696622a730bbe09155445dc1f95af7b9b967f30a22dcfb13c5a89a8de8f02
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D491ADB2A08AC681F761AE25D45277DB291AB40FD8FC84137DA5E863D5DEBCE4058332
                                                                                                                                                                                                                              Function 00007FF7E196EED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                              • Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
                                                                                                                                                                                                                              • Instruction ID: 5ecb7ed5ad553236c4af2d12e6026bce9eace83022386cf57ccb75f04463193c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77819472E082C3C5FB64AF25C1223B8A6A0EB1174CFD58037DA0997695DBBDE9419733
                                                                                                                                                                                                                              Function 00007FF7E195C968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                              • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                              • Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
                                                                                                                                                                                                                              • Instruction ID: 84eaac4ca704b57c5223a949a1f409d9c2fe34655296eeb9bd826e0827be9952
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7251C132B196828ADB14EB15E465B39B799EB44B8CFD08132DA4D537C4EFBCE841C721
                                                                                                                                                                                                                              Function 00007FF7E195E1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                              • Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
                                                                                                                                                                                                                              • Instruction ID: dc7bf5fd2f5409cfd7bb78c0cdb75ab1567aae4deff308969f29e96d54037e2d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4761A7329087C585D721DF25E4513AAF7A0FB84B98F444226EB9D13B95DFBCE190CB21
                                                                                                                                                                                                                              Function 00007FF7E195E5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                                                              • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                              • Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
                                                                                                                                                                                                                              • Instruction ID: 6fc6bceec42fea16760ddec0b81589272ee86b867de6b61d6abf86a68b8d6089
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AC51A1369082C286EB64AF219065378F794EB54B88F944137DA5D53BD1CFBDE450CB32
                                                                                                                                                                                                                              Function 00007FF7E19525F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                              • String ID: Error$Error/warning (ANSI fallback)
                                                                                                                                                                                                                              • API String ID: 1878133881-653037927
                                                                                                                                                                                                                              • Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
                                                                                                                                                                                                                              • Instruction ID: 6658654f23ab74269a25bdbfdc60275afa9753784602a507d8a880cc11b7f1ca
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92115B62A28A8581FB20AB10F462BA9A364FF44B88FD05137EA4D17644DFBCD605C761
                                                                                                                                                                                                                              Function 00007FF7E1952870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                              • String ID: Error/warning (ANSI fallback)$Warning
                                                                                                                                                                                                                              • API String ID: 1878133881-2698358428
                                                                                                                                                                                                                              • Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
                                                                                                                                                                                                                              • Instruction ID: fff03d0a4c4982d614ac913ee6243e8a24c559e1455b27100ac1609379ba8e01
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A8116D72A28BC581FB20AB10F462BA9B364FF44B88FD05136DA8D57644DFBCD605C761
                                                                                                                                                                                                                              Function 00007FF7E196B8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2718003287-0
                                                                                                                                                                                                                              • Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
                                                                                                                                                                                                                              • Instruction ID: fc0de155feb9cf9b52e906f3eb694e113bc32da137465b5030ddfcc4239c4025
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7ED10F32B08A8189E710DF79D4413ACB7B5FB4479CB844236CE5E97B99EE78D116C321
                                                                                                                                                                                                                              Function 00007FF7E1952030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1956198572-0
                                                                                                                                                                                                                              • Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
                                                                                                                                                                                                                              • Instruction ID: f97c4e27fd6401c006289fb848816e2ca6622c7843ec2f85084cf07e73361a14
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4411A921E081D282FB54ABB9F5563B99292FF88B84FC48032DE4917B99CDBDD4C18631
                                                                                                                                                                                                                              Function 00007FF7E1974E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID: ?
                                                                                                                                                                                                                              • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                              • Opcode ID: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
                                                                                                                                                                                                                              • Instruction ID: ce98688e6e8e336761b255ccabb94152ea0f532a4b2ce959d81509a2edcebb70
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF410822B0C6C246FB64AB259407379E654EF80BA8F944236EE5D07AD6DFBCD441C712
                                                                                                                                                                                                                              Function 00007FF7E196832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E196835E
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1969C58: RtlFreeHeap.NTDLL(?,?,?,00007FF7E1972032,?,?,?,00007FF7E197206F,?,?,00000000,00007FF7E1972535,?,?,?,00007FF7E1972467), ref: 00007FF7E1969C6E
                                                                                                                                                                                                                                • Part of subcall function 00007FF7E1969C58: GetLastError.KERNEL32(?,?,?,00007FF7E1972032,?,?,?,00007FF7E197206F,?,?,00000000,00007FF7E1972535,?,?,?,00007FF7E1972467), ref: 00007FF7E1969C78
                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7E195BEC5), ref: 00007FF7E196837C
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID: C:\Users\user\Desktop\1.exe
                                                                                                                                                                                                                              • API String ID: 3580290477-2253474674
                                                                                                                                                                                                                              • Opcode ID: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
                                                                                                                                                                                                                              • Instruction ID: 9bf1b5b7e5cd7a10ab085652fb73f400264d42856a167b335db2731d5b45886b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AD41B431A08BD685EB15FF25A5422BCA394FF45B88B854037EA0E07795DF7CD4818332
                                                                                                                                                                                                                              Function 00007FF7E196F8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CurrentDirectory_invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID: .$:
                                                                                                                                                                                                                              • API String ID: 2020911589-4202072812
                                                                                                                                                                                                                              • Opcode ID: 75108fa0d8fcfebdf0f3dc79d92ab90926721088542d1c76d0744241c3be7838
                                                                                                                                                                                                                              • Instruction ID: bbbc46665500a8ce6b52d443d841112bdeeb80879cc718fbc71b16ce3bc19357
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75108fa0d8fcfebdf0f3dc79d92ab90926721088542d1c76d0744241c3be7838
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 43415132F08B9298FB11EBB198623FC6674AF1475CF940036DE4D67A45EFB894468332
                                                                                                                                                                                                                              Function 00007FF7E196BF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                              • String ID: U
                                                                                                                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                                                                                                                              • Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
                                                                                                                                                                                                                              • Instruction ID: 918f6ef228890a55f4ae526a4b3067b2d760d975cb9173507827526a5f3ddebd
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AA41C522B19AC581DB20EF25E4553A9B761FB88798FC04032EE4E87798EFBCD441C761
                                                                                                                                                                                                                              Function 00007FF7E196E8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CurrentDirectory
                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                              • API String ID: 1611563598-336475711
                                                                                                                                                                                                                              • Opcode ID: 42aabba90d01c53827fde20447a69e74228e2fd19b34bc9bc36161037011c97c
                                                                                                                                                                                                                              • Instruction ID: 70f2d4ac79ce735a0a2d011a626ff820cedd1e12dfdd55e007195252eb9d06f0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 42aabba90d01c53827fde20447a69e74228e2fd19b34bc9bc36161037011c97c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F821C132A086C182EB60EB25D45637EA3A1FF84B4CFD54036DA8D43684CFBCE9458772
                                                                                                                                                                                                                              Function 00007FF7E195F068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                              • Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
                                                                                                                                                                                                                              • Instruction ID: 747711fbd1319c34f866a02233d0efaafaf4b787c6ead4be5138ce3a5b259130
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DF115B36619B8482EB619B25F450269B7E0FB88B98F984232DBCD07B68DF7CC5518B10
                                                                                                                                                                                                                              Function 00007FF7E196FA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.3064073129.00007FF7E1951000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E1950000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064038460.00007FF7E1950000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064144484.00007FF7E197B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E198E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064185011.00007FF7E1994000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.3064292304.00007FF7E1996000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff7e1950000_1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                              • String ID: :
                                                                                                                                                                                                                              • API String ID: 2595371189-336475711
                                                                                                                                                                                                                              • Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
                                                                                                                                                                                                                              • Instruction ID: 1c76a769fb03b21d5e827ef1d41512b634382186336266e950756c73c54bd817
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C9017121A1C28286EB20BF6094733BEA390EF4870CFC00037D55D46691EFBCD5048A36

                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                              Function 00007FF846E233B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 0000001B.00000002.2302826607.00007FF846E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF846E20000, based on PE: false
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_27_2_7ff846e20000_powershell.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
                                                                                                                                                                                                                              • Instruction ID: 32ca7a98610802d4aba52fe6a861fb7224529398b5039a4b1202de15e78a8e77
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4401677111CB0D4FD744EF0CE451AA5B7E0FB95364F10056DE58AC3665DA36E882CB46

                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                              Function 00007FF846E533B5 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 0000001E.00000002.2473632158.00007FF846E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF846E50000, based on PE: false
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_30_2_7ff846e50000_powershell.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
                                                                                                                                                                                                                              • Instruction ID: 959acd7107f3e8b470675841f2119fe64739866b52c3380443c7a31442716b91
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8C01A77010CB0C4FD744EF0CE451AA5B3E0FB85360F10052DE58AC3661DA36E882CB41