Edit tour

Windows Analysis Report
FluxusV2.exe

Overview

General Information

Sample name:	FluxusV2.exe
Analysis ID:	1532353
MD5:	712e80900b6235d74f0c82edfa0cb165
SHA1:	ac466cbf763fb3a3aabbea754546bcb86c765311
SHA256:	7a515b7c74af74acd14cd715c60565a6b6b11026f07fb2a64f324b9ce89090d5
Tags:	exeuser-aachum
Infos:

Detection

Python Stealer, CStealer

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected CStealer

Connects to a pastebin service (likely for C&C)

Yara detected Generic Python Stealer

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

FluxusV2.exe (PID: 1396 cmdline: "C:\Users\user\Desktop\FluxusV2.exe" MD5: 712E80900B6235D74F0C82EDFA0CB165)

FluxusV2.exe (PID: 6656 cmdline: "C:\Users\user\Desktop\FluxusV2.exe" MD5: 712E80900B6235D74F0C82EDFA0CB165)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DynamicStealer	Dynamic Stealer is a Github Project C# written code by L1ghtN4n. This code collects passwords and uploads these to Telegram. According to Cyble this Eternity Stealer leverages code from this project and also Jester Stealer could be rebranded from it.	No Attribution	https://blog.cyble.com/2022/05/12/a-closer-look-at-eternity-malware/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dynamicstealer

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CStealer	Yara detected CStealer	Joe Security
Process Memory Space: FluxusV2.exe PID: 6656	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: FluxusV2.exe PID: 6656	JoeSecurity_CStealer	Yara detected CStealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: FluxusV2.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B83420 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	2_2_00007FFD93B83420
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B211BD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93B211BD
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B69370 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFD93B69370
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2144C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	2_2_00007FFD93B2144C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93B21ACD
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B712E0 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,	2_2_00007FFD93B712E0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2D2E1 CRYPTO_free,	2_2_00007FFD93B2D2E1
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FFD93B21997
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B6D2F0 RAND_bytes_ex,CRYPTO_malloc,memset,	2_2_00007FFD93B6D2F0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,	2_2_00007FFD93B21992
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21ED8 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD93B21ED8
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B652A0 CRYPTO_free,	2_2_00007FFD93B652A0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2230B ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	2_2_00007FFD93B2230B
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2155A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FFD93B2155A
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2B200 CRYPTO_clear_free,	2_2_00007FFD93B2B200
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD93B21483
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B83210 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	2_2_00007FFD93B83210
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B8D170 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	2_2_00007FFD93B8D170
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	2_2_00007FFD93B2111D
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B220EF CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93B220EF
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B81126 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFD93B81126
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2D140 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD93B2D140
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B22121 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD93B22121
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FFD93B21262
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B710C0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD93B710C0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B4D0C0 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	2_2_00007FFD93B4D0C0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B8B0D0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93B8B0D0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2F060 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD93B2F060
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B211DB EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFD93B211DB
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B219E7 CRYPTO_free,	2_2_00007FFD93B219E7
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2162C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FFD93B2162C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B97820 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_new,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93B97820
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21846 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,	2_2_00007FFD93B21846
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B89850 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD93B89850
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2F7F0 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	2_2_00007FFD93B2F7F0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B397B0 CRYPTO_free,CRYPTO_strdup,	2_2_00007FFD93B397B0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2108C ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFD93B2108C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B77770 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93B77770
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21582 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFD93B21582
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B99790 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	2_2_00007FFD93B99790
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B225D6 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	2_2_00007FFD93B225D6
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	2_2_00007FFD93B21087
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B37730 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FFD93B37730
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B4D750 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFD93B4D750
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2176C CRYPTO_malloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	2_2_00007FFD93B2176C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B7F660 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD93B7F660
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B22522 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD93B22522
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21646 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	2_2_00007FFD93B21646
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B635E0 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93B635E0

Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior

Source: FluxusV2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: FluxusV2.exe, 00000002.00000002.3466512977.00007FFDA34D1000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2185301361.000002147A44E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2185301361.000002147A44E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: FluxusV2.exe, 00000002.00000002.3457718111.00007FFD93F99000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2178681248.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3467654716.00007FFDA4343000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: FluxusV2.exe, 00000000.00000003.2178887418.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3467820988.00007FFDA4635000.00000002.00000001.01000000.0000000F.sdmp, VCRUNTIME140_1.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2198823626.000002147A449000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: FluxusV2.exe, 00000002.00000002.3467452455.00007FFDA4171000.00000002.00000001.01000000.00000008.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2189437748.000002147A449000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: FluxusV2.exe, 00000000.00000003.2181127376.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3465888077.00007FFDA3397000.00000002.00000001.01000000.00000012.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2189437748.000002147A449000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.0.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2187285679.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2198925520.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: FluxusV2.exe, 00000002.00000002.3466085065.00007FFDA33D2000.00000002.00000001.01000000.00000010.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: FluxusV2.exe, 00000000.00000003.2181300629.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3466257587.00007FFDA340C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3466958298.00007FFDA3AEE000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2194348754.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: FluxusV2.exe, 00000002.00000002.3466512977.00007FFDA34D1000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3466709403.00007FFDA3A89000.00000002.00000001.01000000.0000000C.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2178887418.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3467820988.00007FFDA4635000.00000002.00000001.01000000.0000000F.sdmp, VCRUNTIME140_1.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: FluxusV2.exe, 00000002.00000002.3459827056.00007FFD944E2000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: FluxusV2.exe, 00000000.00000003.2219623592.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3455651148.00007FFD93B0F000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: FluxusV2.exe, 00000002.00000002.3457718111.00007FFD94031000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: FluxusV2.exe, 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: FluxusV2.exe, 00000000.00000003.2198925520.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2187285679.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2194348754.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: FluxusV2.exe, 00000000.00000003.2178681248.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3467654716.00007FFDA4343000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: FluxusV2.exe, 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: FluxusV2.exe, 00000000.00000003.2185080852.000002147A447000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: FluxusV2.exe, 00000002.00000002.3457718111.00007FFD94031000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2198669377.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: FluxusV2.exe, 00000000.00000003.2191984528.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2185080852.000002147A447000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2185634462.000002147A44E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: FluxusV2.exe, 00000002.00000002.3468131808.00007FFDA5493000.00000002.00000001.01000000.0000000D.sdmp, select.pyd.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2198428524.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2198669377.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: FluxusV2.exe, 00000000.00000003.2181300629.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3466257587.00007FFDA340C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3467292971.00007FFDA3FD3000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2185634462.000002147A44E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2198823626.000002147A449000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: FluxusV2.exe, 00000002.00000002.3467974529.00007FFDA4DA4000.00000002.00000001.01000000.0000000E.sdmp, _wmi.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2191984528.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2198428524.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: FluxusV2.exe, 00000002.00000002.3465109126.00007FFDA331F000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: FluxusV2.exe, 00000002.00000002.3467974529.00007FFDA4DA4000.00000002.00000001.01000000.0000000E.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: FluxusV2.exe, 00000002.00000002.3449827999.0000016AAC0F0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: FluxusV2.exe, 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: FluxusV2.exe, 00000002.00000002.3465572072.00007FFDA336D000.00000002.00000001.01000000.00000014.sdmp, _ssl.pyd.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: api-ms-win-crt-conio-l1-1-0.dll.0.dr

Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1E9280 FindFirstFileExW,FindClose,	0_2_00007FF6EB1E9280
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1E83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6EB1E83C0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB201874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6EB201874
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1E9280 FindFirstFileExW,FindClose,	2_2_00007FF6EB1E9280
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1E83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF6EB1E83C0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB201874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF6EB201874

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: rentry.co

Source: Joe Sandbox View

IP Address: 104.26.3.16 104.26.3.16

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: rentry.co

Source: FluxusV2.exe, 00000002.00000002.3453995121.0000016AAEE68000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE101000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyusering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180274757.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181592397.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182205077.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182051394.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181823053.000002147A446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180274757.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182441388.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180687521.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179873548.000002147A446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181592397.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181823053.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180687521.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179873548.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2217928458.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181127376.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181300629.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2219623592.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182205077.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180249574.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180274757.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181592397.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182205077.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182051394.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181823053.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE380000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2246624033.0000016AAE3AE000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2243222762.0000016AAE3DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE101000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242929132.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2246240328.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2240703105.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2244414701.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249809519.0000016AAE104000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2240583228.0000016AAE4D8000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2240583228.0000016AAE488000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2241794677.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249595801.0000016AAE0F2000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2241185077.0000016AAE149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3449865992.0000016AAC18B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: FluxusV2.exe, 00000002.00000002.3449865992.0000016AAC18B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlE
Source: FluxusV2.exe, 00000002.00000002.3449865992.0000016AAC18B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl_
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crlH
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180274757.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181592397.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182205077.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182051394.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181823053.000002147A446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180274757.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182441388.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180687521.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182051394.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2217928458.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181592397.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181823053.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180687521.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179873548.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2217928458.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181127376.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181300629.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2219623592.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182205077.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180249574.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, _asyncio.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: FluxusV2.exe, 00000000.00000003.2182051394.000002147A446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180274757.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182441388.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180687521.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179873548.000002147A446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE101000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE101000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3453995121.0000016AAEE54000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3454156446.0000016AAEF08000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF021000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE3F7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3453995121.0000016AAEDA0000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE4FD000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE597000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3453995121.0000016AAEDA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: FluxusV2.exe, 00000002.00000002.3453254513.0000016AAE880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: FluxusV2.exe, 00000002.00000002.3453254513.0000016AAE880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: FluxusV2.exe, 00000002.00000002.3453254513.0000016AAE880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: FluxusV2.exe, 00000002.00000003.2248991566.0000016AAE699000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE3F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249144267.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249144267.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE3F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180274757.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182441388.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180687521.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179873548.000002147A446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180274757.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181592397.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182205077.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182051394.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181823053.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180274757.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181592397.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182205077.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182051394.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181823053.000002147A446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181592397.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181823053.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180687521.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179873548.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2217928458.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181127376.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181300629.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2219623592.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182205077.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180249574.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: FluxusV2.exe, 00000002.00000002.3453079932.0000016AAE780000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451662369.0000016AAE280000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2239242527.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE4FD000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3449865992.0000016AAC18B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE380000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: FluxusV2.exe, 00000002.00000002.3454156446.0000016AAEF08000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: FluxusV2.exe, 00000002.00000003.2248991566.0000016AAE699000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3453995121.0000016AAEDA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: FluxusV2.exe, 00000000.00000003.2209521079.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2208905757.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2214196667.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: FluxusV2.exe, 00000000.00000003.2209658513.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2209521079.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2209521079.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2208905757.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: FluxusV2.exe, 00000002.00000002.3453079932.0000016AAE780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE380000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180274757.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182668951.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2181332420.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180840965.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179704848.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182812152.000002147A453000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2182441388.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2180687521.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2179873548.000002147A446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AADF80000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE3F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2246509479.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cpsQt
Source: FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE6C2000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: METADATA14.0.dr	String found in binary or memory: https://PROJECT_RTD.readthedocs.io/en/latest/?badge=latest
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aliexpress.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/servers
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: METADATA0.0.dr	String found in binary or memory: https://backportstarfile.readthedocs.io/en/latest/?badge=latest
Source: METADATA.0.dr	String found in binary or memory: https://badge.fury.io/py/autocommand)
Source: METADATA.0.dr	String found in binary or memory: https://badge.fury.io/py/autocommand.svg)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://binance.com)
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA14.0.dr, METADATA0.0.dr, METADATA2.0.dr, METADATA5.0.dr	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: FluxusV2.exe, 00000002.00000002.3453486541.0000016AAEAA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://checkip.amazonaws.com
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://coinbase.com)
Source: METADATA15.0.dr	String found in binary or memory: https://coveralls.io/github/agronholm/typeguard?branch=master
Source: METADATA15.0.dr	String found in binary or memory: https://coveralls.io/repos/agronholm/typeguard/badge.svg?branch=master&service=github
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crunchyroll.com)
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://dev.to/martinheinz/tour-of-python-itertools-4122
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/users/
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/guilds/
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/users/
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1289473725158391878/cLN93CskNVThBPrDqxHrSB9LVq2DPM4mp4639N5yhSWVE_d
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gift/
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://disney.com)
Source: FluxusV2.exe, 00000002.00000003.2239242527.0000016AAE0D7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242190144.0000016AAE09C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2237019488.0000016AAE0D7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2240703105.0000016AAE0D7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2245807295.0000016AAE09A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242441633.0000016AAE09C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249701711.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2237939798.0000016AAE0D7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2236468018.0000016AAE0D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: METADATA14.0.dr	String found in binary or memory: https://docs.python.org/3.8/library/zipfile.html#path-objects
Source: FluxusV2.exe, 00000002.00000003.2231282819.0000016AADBB2000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2231180441.0000016AADBD9000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450100786.0000016AADA1C000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: FluxusV2.exe, 00000002.00000002.3450100786.0000016AAD9A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: FluxusV2.exe, 00000002.00000002.3450100786.0000016AADA1C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: FluxusV2.exe, 00000002.00000002.3450100786.0000016AADA1C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: FluxusV2.exe, 00000002.00000002.3450100786.0000016AADA1C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: FluxusV2.exe, 00000002.00000002.3450100786.0000016AAD9A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: FluxusV2.exe, 00000002.00000002.3450623615.0000016AADD80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: FluxusV2.exe, 00000002.00000002.3450623615.0000016AADD80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: FluxusV2.exe, 00000002.00000002.3450100786.0000016AADA1C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB40000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2226646059.0000016AADB42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://docs.python.org/3/library/importlib.html#module-importlib.resources
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://docs.python.org/3/library/itertools.html#itertools-recipes
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE3F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ebay.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://epicgames.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://expressvpn.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/
Source: FluxusV2.exe, 00000002.00000002.3453254513.0000016AAE880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com)
Source: FluxusV2.exe, 00000000.00000003.2215030549.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2214916001.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA9.0.dr	String found in binary or memory: https://github.com/ActiveState/appdirs
Source: FluxusV2.exe, 00000000.00000003.2215030549.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2214916001.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA9.0.dr	String found in binary or memory: https://github.com/ActiveState/appdirs/issues/79
Source: METADATA.0.dr	String found in binary or memory: https://github.com/Lucretiel/autocommand
Source: METADATA.0.dr	String found in binary or memory: https://github.com/Lucretiel/autocommand/issues
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Lucretiel/autocommand/issues/18
Source: FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE6F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB40000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2226646059.0000016AADB42000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2224550277.0000016AADB7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: METADATA15.0.dr	String found in binary or memory: https://github.com/agronholm/typeguard
Source: METADATA15.0.dr	String found in binary or memory: https://github.com/agronholm/typeguard/actions/workflows/test.yml
Source: METADATA15.0.dr	String found in binary or memory: https://github.com/agronholm/typeguard/actions/workflows/test.yml/badge.svg
Source: METADATA15.0.dr	String found in binary or memory: https://github.com/agronholm/typeguard/issues
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA14.0.dr, METADATA0.0.dr, METADATA2.0.dr, METADATA5.0.dr	String found in binary or memory: https://github.com/astral-sh/ruff
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://github.com/bbayles
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://github.com/erikrose
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/jaraco/backports.tarfile
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/jaraco/backports.tarfile/actions/workflows/main.yml/badge.svg
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/jaraco/backports.tarfile/actions?query=workflow%3A%22tests%22
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/inflect
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/inflect/actions/workflows/main.yml/badge.svg
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/inflect/actions?query=workflow%3A%22tests%22
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.context
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.context/actions/workflows/main.yml/badge.svg
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.context/actions?query=workflow%3A%22tests%22
Source: FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	String found in binary or memory: https://github.com/jaraco/jaraco.functools
Source: FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	String found in binary or memory: https://github.com/jaraco/jaraco.functools/actions/workflows/main.yml/badge.svg
Source: FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	String found in binary or memory: https://github.com/jaraco/jaraco.functools/actions?query=workflow%3A%22tests%22
Source: FluxusV2.exe, 00000002.00000002.3451662369.0000016AAE280000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.text
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.text/actions/workflows/main.yml/badge.svg
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.text/actions?query=workflow%3A%22tests%22
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/keyring/commit/a85a7cbc6c909f8121660ed1f7b487f99a1c2bf7
Source: METADATA14.0.dr	String found in binary or memory: https://github.com/jaraco/zipp
Source: METADATA14.0.dr	String found in binary or memory: https://github.com/jaraco/zipp/actions/workflows/main.yml/badge.svg
Source: METADATA14.0.dr	String found in binary or memory: https://github.com/jaraco/zipp/actions?query=workflow%3A%22tests%22
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://github.com/more-itertools/more-itertools
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://github.com/more-itertools/more-itertools/graphs/contributors
Source: FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3453254513.0000016AAE880000.00000004.00001000.00020000.00000000.sdmp, METADATA9.0.dr	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA9.0.dr	String found in binary or memory: https://github.com/platformdirs/platformdirs/actions
Source: FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA9.0.dr	String found in binary or memory: https://github.com/platformdirs/platformdirs/actions/workflows/check.yml/badge.svg
Source: FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA9.0.dr	String found in binary or memory: https://github.com/platformdirs/platformdirs/issues
Source: FluxusV2.exe, 00000000.00000003.2214446036.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA16.0.dr	String found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: FluxusV2.exe, 00000002.00000002.3453079932.0000016AAE780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: FluxusV2.exe, 00000000.00000003.2214446036.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging/issues
Source: FluxusV2.exe, 00000002.00000002.3453254513.0000016AAE880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: FluxusV2.exe, 00000002.00000002.3453486541.0000016AAEAA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: FluxusV2.exe, 00000002.00000002.3453486541.0000016AAEAA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
Source: FluxusV2.exe, 00000002.00000002.3450100786.0000016AAD9A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: FluxusV2.exe, 00000002.00000003.2224486878.0000016AADB83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB40000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2226646059.0000016AADB42000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2224550277.0000016AADB7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: FluxusV2.exe, 00000002.00000003.2243102934.0000016AADFA2000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2236363659.0000016AAE3E0000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2239752520.0000016AADF8E000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2236927853.0000016AADFE0000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AADF80000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2236973951.0000016AAE3E0000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2237638476.0000016AADFF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://github.com/python/importlib_resources
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://github.com/python/importlib_resources/actions/workflows/main.yml/badge.svg
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://github.com/python/importlib_resources/actions?query=workflow%3A%22tests%22
Source: FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB40000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2226646059.0000016AADB42000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2224550277.0000016AADB7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gmail.com)
Source: FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE6F4000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB8A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AADF80000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2248449431.0000016AAE64F000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AADF80000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2248449431.0000016AAE64F000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: FluxusV2.exe, 00000002.00000003.2249144267.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hbo.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hotmail.com)
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249144267.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: FluxusV2.exe, 00000002.00000002.3453995121.0000016AAEDA0000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE101000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249809519.0000016AAE104000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249595801.0000016AAE0F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA14.0.dr, METADATA0.0.dr, METADATA2.0.dr, METADATA5.0.dr	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA14.0.dr, METADATA0.0.dr, METADATA2.0.dr, METADATA5.0.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/backports.tarfile.svg
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_resources.svg
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/inflect.svg
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.context.svg
Source: FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.functools.svg
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/jaraco.text.svg
Source: METADATA14.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/zipp.svg
Source: METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/backports.tarfile.svg
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/importlib_resources.svg
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/inflect.svg
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/jaraco.context.svg
Source: FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/jaraco.functools.svg
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/jaraco.text.svg
Source: METADATA14.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/zipp.svg
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://importlib-resources.readthedocs.io/
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/?badge=latest
Source: FluxusV2.exe, 00000002.00000002.3453079932.0000016AAE780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inflect.readthedocs.io/en/latest/?badge=latest
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com)
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jaracocontext.readthedocs.io/en/latest/?badge=latest
Source: FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	String found in binary or memory: https://jaracofunctools.readthedocs.io/en/latest/?badge=latest
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jaracotext.readthedocs.io/en/latest/#jaraco.text.WordSet
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jaracotext.readthedocs.io/en/latest/?badge=latest
Source: FluxusV2.exe, 00000002.00000003.2249144267.0000016AAE5C7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2248991566.0000016AAE699000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: FluxusV2.exe, 00000002.00000003.2241410055.0000016AAE4D7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2246509479.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242787731.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://martinheinz.dev/blog/16
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://media.discordapp.net/attachments/1111364024408494140/1111364181032177766/cs.png
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://minecraft.net)
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.SequenceView
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.adjacent
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.all_equal
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.all_unique
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.always_iterable
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.always_reversible
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.batched
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.before_and_after
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.bucket
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.chunked
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.chunked_even
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.circular_shifts
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.classify_unique
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.collapse
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.combination_index
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.combination_with_replacement
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.consecutive_groups
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.constrained_batches
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.consume
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.consumer
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.convolve
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.count_cycle
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.countable
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.dft
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.difference
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.distinct_combinations
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.distinct_permutations
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.distribute
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.divide
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.dotproduct
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.doublestarmap
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.duplicates_everseen
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.duplicates_justseen
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.exactly_n
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.factor
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.filter_except
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.filter_map
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.first
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.first_true
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.flatten
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.gray_product
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.groupby_transform
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.grouper
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.ichunked
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.idft
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iequals
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.ilen
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.interleave
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.interleave_evenly
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.interleave_longest
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.intersperse
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.is_sorted
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.islice_extended
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iter_except
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iter_index
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iter_suppress
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.iterate
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.join_mappings
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.last
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.locate
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.longest_common_prefix
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.lstrip
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.make_decorator
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.map_except
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.map_reduce
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.mark_ends
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.matmul
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.minmax
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.ncycles
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_combination
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_combination_with_replace
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_or_last
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_permutation
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_product
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.numeric_range
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.one
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.only
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.outer_product
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.pad_none
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.padded
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.pairwise
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.partial_product
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.partition
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.partitions
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.peekable
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.permutation_index
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.polynomial_derivative
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.polynomial_eval
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.polynomial_from_roots
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.powerset
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.powerset_of_sets
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.prepend
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.product_index
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.quantify
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.random_combination
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.random_combination_with_repl
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.random_permutation
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.random_product
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.repeat_each
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.repeat_last
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.repeatfunc
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.replace
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.reshape
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.rlocate
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.roundrobin
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.rstrip
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.run_length
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sample
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.seekable
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.set_partitions
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.side_effect
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sieve
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sliced
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sliding_window
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sort_together
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_after
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_at
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_before
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_into
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_when
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.spy
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.stagger
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.strictly_n
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.strip
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.subslices
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.substrings
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.substrings_indexes
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sum_of_squares
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.tabulate
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.tail
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.take
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.takewhile_inclusive
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.time_limited
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.totient
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.transpose
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.triplewise
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unique
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unique_everseen
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unique_in_window
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unique_justseen
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unique_to_each
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.unzip
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.value_chain
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.windowed
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.windowed_complete
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.with_iter
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.zip_broadcast
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.zip_equal
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.zip_offset
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://more-itertools.readthedocs.io/en/stable/versions.html
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://netflix.com)
Source: FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://origin.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com)
Source: FluxusV2.exe, 00000000.00000003.2214446036.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.pypa.io/
Source: FluxusV2.exe, 00000000.00000003.2214446036.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.pypa.io/en/latest/changelog/
Source: FluxusV2.exe, 00000000.00000003.2214446036.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.pypa.io/en/latest/development/
Source: FluxusV2.exe, 00000000.00000003.2214446036.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.pypa.io/en/latest/security/
Source: FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/All
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE3F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: FluxusV2.exe, 00000000.00000003.2214446036.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/
Source: FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3453486541.0000016AAEAA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://path.readthedocs.io/en/latest/api.html
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://paypal.com)
Source: FluxusV2.exe, 00000002.00000002.3451550125.0000016AAE180000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2234163326.0000016AAE09C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2233771203.0000016AAE09C000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: FluxusV2.exe, 00000002.00000002.3459827056.00007FFD944E2000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://pip.pypa.io/en/stable/
Source: FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA9.0.dr	String found in binary or memory: https://platformdirs.readthedocs.io
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://playstation.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pornhub.com)
Source: METADATA0.0.dr	String found in binary or memory: https://pypi.org/project/backports.tarfile
Source: FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3453486541.0000016AAEAA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://pypi.org/project/importlib_resources
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/inflect
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/jaraco.context
Source: FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	String found in binary or memory: https://pypi.org/project/jaraco.functools
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/jaraco.text
Source: FluxusV2.exe, 00000000.00000003.2210466940.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2210236916.000002147A45A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/word2number/
Source: METADATA14.0.dr	String found in binary or memory: https://pypi.org/project/zipp
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/wtf
Source: METADATA14.0.dr	String found in binary or memory: https://readthedocs.org/projects/PROJECT_RTD/badge/?version=latest
Source: METADATA0.0.dr	String found in binary or memory: https://readthedocs.org/projects/backportstarfile/badge/?version=latest
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://readthedocs.org/projects/importlib-resources/badge/?version=latest
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/inflect/badge/?version=latest
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/jaracocontext/badge/?version=latest
Source: FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	String found in binary or memory: https://readthedocs.org/projects/jaracofunctools/badge/?version=latest
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/jaracotext/badge/?version=latest
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://readthedocs.org/projects/more-itertools/badge/?version=latest
Source: METADATA15.0.dr	String found in binary or memory: https://readthedocs.org/projects/typeguard/badge/?version=latest
Source: FluxusV2.exe, 00000002.00000002.3453254513.0000016AAE880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/5uu99/raw
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/n9t3khws/raw
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/n9t3khws/rawdll
Source: FluxusV2.exe, 00000002.00000002.3454822290.0000016AAF87C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/u4tup/raw
Source: FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/u7hcdw7r/raw
Source: FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/u7hcdw7r/rawinfo
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE101000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249809519.0000016AAE104000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3454156446.0000016AAEED0000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249595801.0000016AAE0F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: FluxusV2.exe, 00000002.00000002.3454156446.0000016AAEED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.ioxe
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://riotgames.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://roblox.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sellix.io)
Source: FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: FluxusV2.exe, 00000002.00000003.2235660852.0000016AADF83000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2235736532.0000016AAE10A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2235111691.0000016AAE10A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: FluxusV2.exe, 00000002.00000003.2239242527.0000016AAE152000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE101000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242929132.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2246240328.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2240703105.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2244414701.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2236468018.0000016AAE152000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249809519.0000016AAE104000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2235736532.0000016AAE10A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2237019488.0000016AAE152000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2241794677.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2235111691.0000016AAE10A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2238515249.0000016AAE152000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249595801.0000016AAE0F2000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2235779864.0000016AAE0D9000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2235111691.0000016AAE0D8000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2241185077.0000016AAE149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: FluxusV2.exe, 00000002.00000002.3451550125.0000016AAE180000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: FluxusV2.exe, 00000002.00000003.2235736532.0000016AAE10A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2235111691.0000016AAE10A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2235111691.0000016AADFC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;
Source: FluxusV2.exe, 00000002.00000003.2235736532.0000016AAE10A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2235111691.0000016AAE10A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2235111691.0000016AADFC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;r
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://setuptools.readthedocs.io/en/latest/pkg_resources.html
Source: FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA9.0.dr	String found in binary or memory: https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spotify.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stake.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steam.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://telegram.com)
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-resources
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/inflect
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.context
Source: FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	String found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.functools
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/jaraco.text
Source: METADATA14.0.dr	String found in binary or memory: https://tidelift.com/badges/package/pypi/zipp
Source: FluxusV2.exe, 00000000.00000003.2210466940.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2210236916.000002147A45A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-PROJECT?utm_source=pypi-PROJECT&utm_medium=referral&utm_c
Source: FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-resources?utm_source=pypi-importlib-resources&u
Source: FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-inflect?utm_source=pypi-inflect&utm_medium=readme
Source: FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.context?utm_source=pypi-jaraco.context&utm_medium=
Source: FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.functools?utm_source=pypi-jaraco.functools&utm_med
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.text?utm_source=pypi-jaraco.text&utm_medium=readme
Source: FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-jaraco.text?utm_source=pypi-jaraco.text&utm_medium=referr
Source: METADATA14.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-zipp?utm_source=pypi-zipp&utm_medium=readme
Source: METADATA14.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-zipp?utm_source=pypi-zipp&utm_medium=referral&utm_campaig
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com)
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE101000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249595801.0000016AAE0F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: FluxusV2.exe, 00000002.00000003.2242441633.0000016AAE085000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2243075364.0000016AAE506000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2245807295.0000016AAE09A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242441633.0000016AAE09C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249701711.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitch.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com)
Source: FluxusV2.exe, 00000002.00000002.3452755943.0000016AAE6F4000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: METADATA15.0.dr	String found in binary or memory: https://typeguard.readthedocs.io/en/latest/
Source: METADATA15.0.dr	String found in binary or memory: https://typeguard.readthedocs.io/en/latest/?badge=latest
Source: METADATA15.0.dr	String found in binary or memory: https://typeguard.readthedocs.io/en/latest/versionhistory.html
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://uber.com)
Source: FluxusV2.exe, 00000002.00000002.3453486541.0000016AAEAA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://upload.pypi.org/legacy/
Source: FluxusV2.exe, 00000002.00000002.3453486541.0000016AAEAA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://upload.pypi.org/legacy/p
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: FluxusV2.exe, 00000002.00000003.2248991566.0000016AAE699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE101000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242929132.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2246240328.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2240703105.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2244414701.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249809519.0000016AAE104000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2240583228.0000016AAE4D8000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2240583228.0000016AAE488000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2241794677.0000016AAE119000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249595801.0000016AAE0F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://www.bbayles.com/index/decorator_factory
Source: FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	String found in binary or memory: https://www.gidware.com/real-world-more-itertools/
Source: FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE4FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: FluxusV2.exe, 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmp, FluxusV2.exe, 00000002.00000002.3458975785.00007FFD940DA000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE101000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249809519.0000016AAE104000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249595801.0000016AAE0F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: FluxusV2.exe, 00000002.00000003.2241410055.0000016AAE4D7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2246509479.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242787731.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: METADATA15.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0484/
Source: FluxusV2.exe, 00000002.00000002.3460544647.00007FFD94658000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: FluxusV2.exe, 00000002.00000002.3459827056.00007FFD944E2000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://xbox.com)
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com)
Source: FluxusV2.exe, 00000002.00000002.3450853819.0000016AADF80000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2248449431.0000016AAE64F000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com)

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB205C00	0_2_00007FF6EB205C00
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB206964	0_2_00007FF6EB206964
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1E89E0	0_2_00007FF6EB1E89E0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1E1000	0_2_00007FF6EB1E1000
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1EACAD	0_2_00007FF6EB1EACAD
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1EA47B	0_2_00007FF6EB1EA47B
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F5D30	0_2_00007FF6EB1F5D30
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F1B50	0_2_00007FF6EB1F1B50
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB2008C8	0_2_00007FF6EB2008C8
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB206418	0_2_00007FF6EB206418
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F2C10	0_2_00007FF6EB1F2C10
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB203C10	0_2_00007FF6EB203C10
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1FDA5C	0_2_00007FF6EB1FDA5C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1EA2DB	0_2_00007FF6EB1EA2DB
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F2164	0_2_00007FF6EB1F2164
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F1944	0_2_00007FF6EB1F1944
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F39A4	0_2_00007FF6EB1F39A4
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB201874	0_2_00007FF6EB201874
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB2040AC	0_2_00007FF6EB2040AC
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F80E4	0_2_00007FF6EB1F80E4
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB2008C8	0_2_00007FF6EB2008C8
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F1F60	0_2_00007FF6EB1F1F60
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F1740	0_2_00007FF6EB1F1740
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F8794	0_2_00007FF6EB1F8794
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1E9800	0_2_00007FF6EB1E9800
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F9EA0	0_2_00007FF6EB1F9EA0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB205E7C	0_2_00007FF6EB205E7C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1FDEF0	0_2_00007FF6EB1FDEF0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB209728	0_2_00007FF6EB209728
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1FE570	0_2_00007FF6EB1FE570
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F1D54	0_2_00007FF6EB1F1D54
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1F35A0	0_2_00007FF6EB1F35A0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB205C00	2_2_00007FF6EB205C00
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB206964	2_2_00007FF6EB206964
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1E1000	2_2_00007FF6EB1E1000
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1EACAD	2_2_00007FF6EB1EACAD
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1EA47B	2_2_00007FF6EB1EA47B
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F5D30	2_2_00007FF6EB1F5D30
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F1B50	2_2_00007FF6EB1F1B50
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB2008C8	2_2_00007FF6EB2008C8
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB206418	2_2_00007FF6EB206418
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F2C10	2_2_00007FF6EB1F2C10
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB203C10	2_2_00007FF6EB203C10
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1FDA5C	2_2_00007FF6EB1FDA5C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1EA2DB	2_2_00007FF6EB1EA2DB
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F2164	2_2_00007FF6EB1F2164
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F1944	2_2_00007FF6EB1F1944
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F39A4	2_2_00007FF6EB1F39A4
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1E89E0	2_2_00007FF6EB1E89E0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB201874	2_2_00007FF6EB201874
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB2040AC	2_2_00007FF6EB2040AC
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F80E4	2_2_00007FF6EB1F80E4
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB2008C8	2_2_00007FF6EB2008C8
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F1F60	2_2_00007FF6EB1F1F60
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F1740	2_2_00007FF6EB1F1740
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F8794	2_2_00007FF6EB1F8794
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1E9800	2_2_00007FF6EB1E9800
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F9EA0	2_2_00007FF6EB1F9EA0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB205E7C	2_2_00007FF6EB205E7C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1FDEF0	2_2_00007FF6EB1FDEF0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB209728	2_2_00007FF6EB209728
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1FE570	2_2_00007FF6EB1FE570
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F1D54	2_2_00007FF6EB1F1D54
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1F35A0	2_2_00007FF6EB1F35A0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93944440	2_2_00007FFD93944440
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938E7420	2_2_00007FFD938E7420
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93926430	2_2_00007FFD93926430
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9390A430	2_2_00007FFD9390A430
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9392B3C0	2_2_00007FFD9392B3C0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938AD2F0	2_2_00007FFD938AD2F0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938AF2E0	2_2_00007FFD938AF2E0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93887316	2_2_00007FFD93887316
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9389C330	2_2_00007FFD9389C330
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93899260	2_2_00007FFD93899260
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93938260	2_2_00007FFD93938260
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938832D5	2_2_00007FFD938832D5
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938A2210	2_2_00007FFD938A2210
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD939271F0	2_2_00007FFD939271F0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9390E220	2_2_00007FFD9390E220
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9389D250	2_2_00007FFD9389D250
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93935180	2_2_00007FFD93935180
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93892190	2_2_00007FFD93892190
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9392E170	2_2_00007FFD9392E170
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9390C0F0	2_2_00007FFD9390C0F0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93884100	2_2_00007FFD93884100
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93884800	2_2_00007FFD93884800
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93939850	2_2_00007FFD93939850
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9388A850	2_2_00007FFD9388A850
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938E0790	2_2_00007FFD938E0790
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD939087D0	2_2_00007FFD939087D0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938DE740	2_2_00007FFD938DE740
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938DB670	2_2_00007FFD938DB670
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD939275F0	2_2_00007FFD939275F0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93893600	2_2_00007FFD93893600
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93925630	2_2_00007FFD93925630
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938A4560	2_2_00007FFD938A4560
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938B15A0	2_2_00007FFD938B15A0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938AE5A0	2_2_00007FFD938AE5A0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93884550	2_2_00007FFD93884550
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938CA540	2_2_00007FFD938CA540
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93937470	2_2_00007FFD93937470
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938F4480	2_2_00007FFD938F4480
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9392A4A0	2_2_00007FFD9392A4A0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938894C0	2_2_00007FFD938894C0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93883BF0	2_2_00007FFD93883BF0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9389CBF0	2_2_00007FFD9389CBF0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938E4BF0	2_2_00007FFD938E4BF0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938D6C10	2_2_00007FFD938D6C10
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93889B80	2_2_00007FFD93889B80
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938EBBD0	2_2_00007FFD938EBBD0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93938A80	2_2_00007FFD93938A80
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9393A9F0	2_2_00007FFD9393A9F0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93931A40	2_2_00007FFD93931A40
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938E2A20	2_2_00007FFD938E2A20
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938A9980	2_2_00007FFD938A9980
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9388F9A0	2_2_00007FFD9388F9A0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938968E0	2_2_00007FFD938968E0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938EC910	2_2_00007FFD938EC910
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9388286E	2_2_00007FFD9388286E
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938F7860	2_2_00007FFD938F7860
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938C5890	2_2_00007FFD938C5890
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938F28B6	2_2_00007FFD938F28B6
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9391CFF0	2_2_00007FFD9391CFF0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938A8000	2_2_00007FFD938A8000
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938FD030	2_2_00007FFD938FD030
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938A7020	2_2_00007FFD938A7020
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938C4E80	2_2_00007FFD938C4E80
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93890D70	2_2_00007FFD93890D70
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93912D90	2_2_00007FFD93912D90
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938ADD90	2_2_00007FFD938ADD90
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93904D90	2_2_00007FFD93904D90
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938DBD80	2_2_00007FFD938DBD80
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938D0DB0	2_2_00007FFD938D0DB0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93918DD0	2_2_00007FFD93918DD0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9390ADD0	2_2_00007FFD9390ADD0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938DCD00	2_2_00007FFD938DCD00
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938BCC79	2_2_00007FFD938BCC79
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93899CB0	2_2_00007FFD93899CB0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD938CBCB0	2_2_00007FFD938CBCB0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9392FCA0	2_2_00007FFD9392FCA0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD9388BCC0	2_2_00007FFD9388BCC0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93A012F0	2_2_00007FFD93A012F0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93A01880	2_2_00007FFD93A01880
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B21FD7	2_2_00007FFD93B21FD7
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B69370	2_2_00007FFD93B69370
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B6D2F0	2_2_00007FFD93B6D2F0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B2155A	2_2_00007FFD93B2155A
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B370B0	2_2_00007FFD93B370B0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B6D7C0	2_2_00007FFD93B6D7C0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B65770	2_2_00007FFD93B65770
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93B4B700	2_2_00007FFD93B4B700

Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: String function: 00007FFD93889330 appears 136 times
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: String function: 00007FFD93B9C181 appears 251 times
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: String function: 00007FF6EB1E2710 appears 104 times
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: String function: 00007FFD93B21325 appears 97 times
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: String function: 00007FFD93B9C16F appears 80 times
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: String function: 00007FFD9388A490 appears 178 times
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: String function: 00007FFD938B1E20 appears 33 times
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: String function: 00007FF6EB1E2910 appears 34 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found

Source: FluxusV2.exe, 00000000.00000003.2198669377.000002147A44F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2185301361.000002147A44E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2182648898.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2182414342.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2181098313.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2187285679.000002147A44F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2218996208.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2181592397.000002147A446000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2189437748.000002147A449000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2185634462.000002147A44E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2181823053.000002147A446000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2194348754.000002147A44F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2198823626.000002147A449000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2180687521.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2191984528.000002147A44F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2198428524.000002147A44F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2178704510.000002147A453000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2217928458.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2178887418.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2198925520.000002147A44F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2181300629.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2219623592.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2178681248.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2180249574.000002147A44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000000.00000003.2185080852.000002147A447000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs FluxusV2.exe
Source: FluxusV2.exe	Binary or memory string: OriginalFilename vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3468036921.00007FFDA4DA8000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3466823570.00007FFDA3A93000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3456054281.00007FFD93B14000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3467357827.00007FFDA3FD6000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3467516199.00007FFDA417E000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3465965620.00007FFDA339E000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3449827999.0000016AAC0F0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3465770367.00007FFDA3389000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3466608654.00007FFDA350C000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenamelibsslH vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3468212414.00007FFDA5496000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3467719901.00007FFDA4349000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3465189237.00007FFDA332B000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3466364549.00007FFDA3415000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3466161062.00007FFDA33DE000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3461139387.00007FFD94781000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3467050021.00007FFDA3AF3000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3458975785.00007FFD940DA000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs FluxusV2.exe
Source: FluxusV2.exe, 00000002.00000002.3467883189.00007FFDA4639000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs FluxusV2.exe

Source: classification engine

Classification label: mal64.troj.winEXE@3/226@1/1

Source: C:\Users\user\Desktop\FluxusV2.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI13962

Jump to behavior

Source: FluxusV2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FluxusV2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT action_url, username_value, password_value FROM logins;
Source: FluxusV2.exe, 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: FluxusV2.exe, 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: FluxusV2.exe, 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: FluxusV2.exe, 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: FluxusV2.exe, FluxusV2.exe, 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: FluxusV2.exe, 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: FluxusV2.exe, 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: FluxusV2.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\FluxusV2.exe

File read: C:\Users\user\Desktop\FluxusV2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FluxusV2.exe "C:\Users\user\Desktop\FluxusV2.exe"
Source: C:\Users\user\Desktop\FluxusV2.exe	Process created: C:\Users\user\Desktop\FluxusV2.exe "C:\Users\user\Desktop\FluxusV2.exe"
Source: C:\Users\user\Desktop\FluxusV2.exe	Process created: C:\Users\user\Desktop\FluxusV2.exe "C:\Users\user\Desktop\FluxusV2.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Section loaded: wintypes.dll	Jump to behavior

Source: FluxusV2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: FluxusV2.exe

Static file information: File size 17331825 > 1048576

Source: FluxusV2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FluxusV2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FluxusV2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FluxusV2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FluxusV2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FluxusV2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: FluxusV2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: FluxusV2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: FluxusV2.exe, 00000002.00000002.3466512977.00007FFDA34D1000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2185301361.000002147A44E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2185301361.000002147A44E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: FluxusV2.exe, 00000002.00000002.3457718111.00007FFD93F99000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2178681248.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3467654716.00007FFDA4343000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: FluxusV2.exe, 00000000.00000003.2181555075.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: FluxusV2.exe, 00000000.00000003.2178887418.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3467820988.00007FFDA4635000.00000002.00000001.01000000.0000000F.sdmp, VCRUNTIME140_1.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2198823626.000002147A449000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: FluxusV2.exe, 00000002.00000002.3467452455.00007FFDA4171000.00000002.00000001.01000000.00000008.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2189437748.000002147A449000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: FluxusV2.exe, 00000000.00000003.2181127376.000002147A446000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3465888077.00007FFDA3397000.00000002.00000001.01000000.00000012.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2189437748.000002147A449000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: FluxusV2.exe, 00000000.00000003.2179676518.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.0.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2187285679.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2198925520.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: FluxusV2.exe, 00000002.00000002.3466085065.00007FFDA33D2000.00000002.00000001.01000000.00000010.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: FluxusV2.exe, 00000000.00000003.2181300629.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3466257587.00007FFDA340C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: FluxusV2.exe, 00000000.00000003.2179848824.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3466958298.00007FFDA3AEE000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2194348754.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: FluxusV2.exe, 00000002.00000002.3466512977.00007FFDA34D1000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: FluxusV2.exe, 00000000.00000003.2182188652.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3466709403.00007FFDA3A89000.00000002.00000001.01000000.0000000C.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2178887418.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3467820988.00007FFDA4635000.00000002.00000001.01000000.0000000F.sdmp, VCRUNTIME140_1.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: FluxusV2.exe, 00000002.00000002.3459827056.00007FFD944E2000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: FluxusV2.exe, 00000000.00000003.2219623592.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3455651148.00007FFD93B0F000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: FluxusV2.exe, 00000002.00000002.3457718111.00007FFD94031000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: FluxusV2.exe, 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: FluxusV2.exe, 00000000.00000003.2198925520.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2187285679.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2194348754.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: FluxusV2.exe, 00000000.00000003.2181763447.000002147A44C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: FluxusV2.exe, 00000000.00000003.2178681248.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3467654716.00007FFDA4343000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: FluxusV2.exe, 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: FluxusV2.exe, 00000000.00000003.2185080852.000002147A447000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: FluxusV2.exe, 00000002.00000002.3457718111.00007FFD94031000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2198669377.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: FluxusV2.exe, 00000000.00000003.2191984528.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2185080852.000002147A447000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2185634462.000002147A44E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: FluxusV2.exe, 00000002.00000002.3468131808.00007FFDA5493000.00000002.00000001.01000000.0000000D.sdmp, select.pyd.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2198428524.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: FluxusV2.exe, 00000000.00000003.2198669377.000002147A44F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: FluxusV2.exe, 00000000.00000003.2181300629.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3466257587.00007FFDA340C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: FluxusV2.exe, 00000000.00000003.2182017404.000002147A44C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3467292971.00007FFDA3FD3000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2185634462.000002147A44E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2198823626.000002147A449000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: FluxusV2.exe, 00000002.00000002.3467974529.00007FFDA4DA4000.00000002.00000001.01000000.0000000E.sdmp, _wmi.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2191984528.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: FluxusV2.exe, 00000000.00000003.2198428524.000002147A44F000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: FluxusV2.exe, 00000002.00000002.3465109126.00007FFDA331F000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: FluxusV2.exe, 00000002.00000002.3467974529.00007FFDA4DA4000.00000002.00000001.01000000.0000000E.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: FluxusV2.exe, 00000002.00000002.3449827999.0000016AAC0F0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: FluxusV2.exe, 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: FluxusV2.exe, 00000002.00000002.3465572072.00007FFDA336D000.00000002.00000001.01000000.00000014.sdmp, _ssl.pyd.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: api-ms-win-crt-conio-l1-1-0.dll.0.dr

Source: FluxusV2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FluxusV2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FluxusV2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FluxusV2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FluxusV2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140_1.dll.0.dr

Static PE information: 0xFB76EAA0 [Mon Sep 10 13:35:28 2103 UTC]

Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior

Source: C:\Users\user\Desktop\FluxusV2.exe

Code function: 0_2_00007FF6EB1E5830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF6EB1E5830

Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\FluxusV2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\FluxusV2.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17227

Source: C:\Users\user\Desktop\FluxusV2.exe

API coverage: 3.0 %

Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1E9280 FindFirstFileExW,FindClose,	0_2_00007FF6EB1E9280
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1E83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6EB1E83C0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB201874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6EB201874
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1E9280 FindFirstFileExW,FindClose,	2_2_00007FF6EB1E9280
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1E83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF6EB1E83C0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB201874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF6EB201874

Source: C:\Users\user\Desktop\FluxusV2.exe

Code function: 2_2_00007FFD938911E0 GetSystemInfo,

2_2_00007FFD938911E0

Source: FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWwing%SystemRoot%\system32\mswsock.dll__str__
Source: cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: System32\vmGuestLib.dll
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dSystem32\vmGuestLib.dll
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxmrxnp.dll
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvboxmrxnp.dll
Source: FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fVMWARE
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: C:\Users\user\Desktop\FluxusV2.exe

Code function: 0_2_00007FF6EB1ED12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6EB1ED12C

Source: C:\Users\user\Desktop\FluxusV2.exe

Code function: 0_2_00007FF6EB203480 GetProcessHeap,

0_2_00007FF6EB203480

Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1ED30C SetUnhandledExceptionFilter,	0_2_00007FF6EB1ED30C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1EC8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6EB1EC8A0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1ED12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6EB1ED12C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 0_2_00007FF6EB1FA614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6EB1FA614
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1ED30C SetUnhandledExceptionFilter,	2_2_00007FF6EB1ED30C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1EC8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF6EB1EC8A0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1ED12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF6EB1ED12C
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FF6EB1FA614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF6EB1FA614
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD939B2BE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD939B2BE0
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93A03028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD93A03028
Source: C:\Users\user\Desktop\FluxusV2.exe	Code function: 2_2_00007FFD93A02A70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD93A02A70

Source: C:\Users\user\Desktop\FluxusV2.exe

Process created: C:\Users\user\Desktop\FluxusV2.exe "C:\Users\user\Desktop\FluxusV2.exe"

Jump to behavior

Source: C:\Users\user\Desktop\FluxusV2.exe

Code function: 0_2_00007FF6EB209570 cpuid

0_2_00007FF6EB209570

Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\autocommand-2.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\backports.tarfile-1.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_resources-6.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\inflect-7.3.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.context-5.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\more_itertools-10.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\more_itertools-10.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\more_itertools-10.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\packaging-24.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\platformdirs-4.2.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\tomli-2.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typing_extensions-4.12.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typing_extensions-4.12.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typing_extensions-4.12.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\zipp-3.19.2.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_wmi.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FluxusV2.exe	Queries volume information: C:\Users\user\Desktop\FluxusV2.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\FluxusV2.exe

Code function: 0_2_00007FF6EB1ED010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6EB1ED010

Source: C:\Users\user\Desktop\FluxusV2.exe

Code function: 0_2_00007FF6EB205C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6EB205C00

Stealing of Sensitive Information

Yara detected CStealer

Source: Yara match	File source: 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FluxusV2.exe PID: 6656, type: MEMORYSTR

Yara detected Generic Python Stealer

Source: Yara match

File source: Process Memory Space: FluxusV2.exe PID: 6656, type: MEMORYSTR

Remote Access Functionality

Yara detected CStealer

Source: Yara match	File source: 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FluxusV2.exe PID: 6656, type: MEMORYSTR

Yara detected Generic Python Stealer

Source: Yara match

File source: Process Memory Space: FluxusV2.exe PID: 6656, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FluxusV2.exe	32%	ReversingLabs	Win64.Trojan.PyCStealer

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_x25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_cffi_backend.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.quovadisglobal.com/cps0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rentry.co	104.26.3.16	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/jaraco/keyring/commit/a85a7cbc6c909f8121660ed1f7b487f99a1c2bf7	FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/pyversions/backports.tarfile.svg	METADATA0.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.filter_except	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://readthedocs.org/projects/typeguard/badge/?version=latest	METADATA15.0.dr	false		unknown
https://discord.gift/	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	FluxusV2.exe, 00000002.00000002.3451550125.0000016AAE180000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://readthedocs.org/projects/jaracofunctools/badge/?version=latest	FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.zip_broadcast	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
http://www.quovadisglobal.com/cpsQt	FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com)	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/jaraco.text/actions?query=workflow%3A%22tests%22	FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#module-importlib.resources	FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	false		unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB40000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2226646059.0000016AADB42000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2224550277.0000016AADB7A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.random_product	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.groupby_transform	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://importlib-metadata.readthedocs.io/	FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.sliding_window	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	FluxusV2.exe, 00000002.00000003.2239242527.0000016AAE0D7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242190144.0000016AAE09C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2237019488.0000016AAE0D7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2240703105.0000016AAE0D7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2245807295.0000016AAE09A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242441633.0000016AAE09C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249701711.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2237939798.0000016AAE0D7000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2236468018.0000016AAE0D7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://paypal.com)	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/pypa/packaging	FluxusV2.exe, 00000002.00000002.3453079932.0000016AAE780000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/ActiveState/appdirs/issues/79	FluxusV2.exe, 00000000.00000003.2215030549.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2214916001.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA9.0.dr	false		unknown
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html	FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA9.0.dr	false		unknown
https://blog.jaraco.com/skeleton	FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2209680912.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA14.0.dr, METADATA0.0.dr, METADATA2.0.dr, METADATA5.0.dr	false		unknown
https://tools.ietf.org/html/rfc3610	FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.all_unique	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.partial_product	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://img.shields.io/pypi/pyversions/inflect.svg	FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/zipp/actions/workflows/main.yml/badge.svg	METADATA14.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.map_except	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://rentry.co/n9t3khws/raw	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md	FluxusV2.exe, 00000000.00000003.2214446036.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA16.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.takewhile_inclusive	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://tidelift.com/subscription/pkg/pypi-jaraco.text?utm_source=pypi-jaraco.text&utm_medium=readme	FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	FluxusV2.exe, 00000002.00000002.3450100786.0000016AAD9A0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.powerset	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.zip_offset	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://crunchyroll.com)	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/jaraco.context/actions?query=workflow%3A%22tests%22	FluxusV2.exe, 00000000.00000003.2211711180.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://pypi.org/project/build/).	FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3453486541.0000016AAEAA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://wwww.certigna.fr/autorites/0m	FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.pad_none	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://dev.to/martinheinz/tour-of-python-itertools-4122	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB40000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2226646059.0000016AADB42000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2224550277.0000016AADB7A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/python/cpython/issues/86361.	FluxusV2.exe, 00000002.00000003.2243102934.0000016AADFA2000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2236363659.0000016AAE3E0000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2239752520.0000016AADF8E000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2236927853.0000016AADFE0000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AADF80000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2236973951.0000016AAE3E0000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2237638476.0000016AADFF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tidelift.com/subscription/pkg/pypi-inflect?utm_source=pypi-inflect&utm_medium=readme	FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/v/zipp.svg	METADATA14.0.dr	false		unknown
https://ebay.com)	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	FluxusV2.exe, 00000002.00000002.3450623615.0000016AADD80000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	FluxusV2.exe, 00000002.00000002.3450623615.0000016AADD80000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/v/inflect.svg	FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://playstation.com)	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3.8/library/zipfile.html#path-objects	METADATA14.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.ncycles	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://readthedocs.org/projects/PROJECT_RTD/badge/?version=latest	METADATA14.0.dr	false		unknown
https://sellix.io)	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	FluxusV2.exe, 00000002.00000002.3453486541.0000016AAEAA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.consume	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://discord.com/api/v6/guilds/	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://jaracotext.readthedocs.io/en/latest/?badge=latest	FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_when	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.consumer	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://packaging.pypa.io/en/latest/development/	FluxusV2.exe, 00000000.00000003.2214446036.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.cert.fnmt.es/dpcs/	FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE380000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3454400468.0000016AAF030000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/platformdirs/platformdirs/actions/workflows/check.yml/badge.svg	FluxusV2.exe, 00000000.00000003.2214916001.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA9.0.dr	false		unknown
https://google.com/mail	FluxusV2.exe, 00000002.00000002.3450853819.0000016AADF80000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2248449431.0000016AAE64F000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3451901073.0000016AAE653000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/v/importlib_metadata.svg	FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.nth_combination_with_replace	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://typeguard.readthedocs.io/en/latest/	METADATA15.0.dr	false		unknown
https://www.python.org/dev/peps/pep-0484/	METADATA15.0.dr	false		unknown
https://rentry.co/u7hcdw7r/raw	FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/backports.tarfile/actions/workflows/main.yml/badge.svg	METADATA0.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.intersperse	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://readthedocs.org/projects/inflect/badge/?version=latest	FluxusV2.exe, 00000000.00000003.2210236916.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.collapse	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://rentry.co/u7hcdw7r/rawinfo	FluxusV2.exe, 00000002.00000002.3453647252.0000016AAEBA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://tools.ietf.org/html/rfc7231#section-4.3.6)	FluxusV2.exe, 00000002.00000003.2242441633.0000016AAE085000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2243075364.0000016AAE506000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000002.3450853819.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2245807295.0000016AAE09A000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2242441633.0000016AAE09C000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2249701711.0000016AAE094000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.one	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://pypi.org/project/jaraco.text	FluxusV2.exe, 00000000.00000003.2212810268.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	FluxusV2.exe, 00000002.00000002.3450100786.0000016AADA1C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://netflix.com)	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/urllib3/urllib3/issues/2920	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://packaging.pypa.io/	FluxusV2.exe, 00000000.00000003.2214446036.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	FluxusV2.exe, 00000002.00000002.3450369252.0000016AADB40000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000002.00000003.2226646059.0000016AADB42000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/jaraco/jaraco.functools/actions?query=workflow%3A%22tests%22	FluxusV2.exe, 00000000.00000003.2212281292.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA5.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.countable	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, FluxusV2.exe, 00000000.00000003.2213691519.000002147A45A000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.matmul	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.prepend	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://outlook.com)	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22	FluxusV2.exe, 00000000.00000003.2209068814.000002147A44D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.product_index	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.set_partitions	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
http://www.quovadisglobal.com/cps0	FluxusV2.exe, 00000002.00000002.3450853819.0000016AADFD5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.only	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://spotify.com)	FluxusV2.exe, 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/agronholm/typeguard/issues	METADATA15.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.bucket	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.distinct_permutations	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://more-itertools.readthedocs.io/en/stable/api.html#more_itertools.split_into	FluxusV2.exe, 00000000.00000003.2213549113.000002147A44D000.00000004.00000020.00020000.00000000.sdmp, METADATA7.0.dr	false		unknown
https://pypi.org/project/zipp	METADATA14.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.3.16	rentry.co	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532353
Start date and time:	2024-10-13 01:29:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FluxusV2.exe
Detection:	MAL
Classification:	mal64.troj.winEXE@3/226@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 70 Number of non-executed functions: 230
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
VT rate limit hit for: FluxusV2.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.3.16	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Win64.TrojanX-gen.20834.9882.exe	Get hash	malicious	Unknown	Browse
	4wx72yFLka.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse
	quotation.js	Get hash	malicious	Unknown	Browse
	Quote.js	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.9087.16441.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.11541.5330.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.9087.16441.exe	Get hash	malicious	Unknown	Browse
	CV.vbs	Get hash	malicious	Xmrig	Browse
	system47.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
rentry.co	egFMhHSlmf.exe	Get hash	malicious	Xmrig	Browse	104.26.3.16
	x2Yi9Hr77a.exe	Get hash	malicious	XWorm	Browse	172.67.75.40
	SecuriteInfo.com.Win64.TrojanX-gen.20834.9882.exe	Get hash	malicious	Unknown	Browse	172.67.75.40
	MPX283rT19.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.2.16
	f2q2w9rTqd.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.2.16
	file.exe	Get hash	malicious	XWorm	Browse	104.26.2.16
	yhDRFwEXdd.cmd	Get hash	malicious	Unknown	Browse	172.67.75.40
	4wx72yFLka.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse	104.26.3.16
	0U9NY2PzhK.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse	172.67.75.40
	qlk8old6p9.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse	172.67.75.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Solara.exe	Get hash	malicious	LummaC	Browse	104.21.77.78
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://confortdelaine.net/_t/c/A1020005-17FCBF5826D778A0-C9FF7535?l=AAAjUdfNc16+VqCOWdjhu7TjhebDwXm6ITDaAzM2/RBqTCouOd4syZWt0oQeHch0J32d09qewtBep0xMzEqQw5uCDD5jzGMptv2Ml8tKG/C8CtlmUW+BwgihXDjkVb9+HrdQMTDnH/ltKCqbqkeSWCTVbTbsi7hQm50lkSO+uIKP+WaZVK5CwB+KNw5vz0h1+VWB9nXYS7r/65KwDXG1eoQ7LpgExf5uqFhJOeKU2lxyf8MZFWma+Jpcd8qAgpI5cl3w3zd+Vm0EYEfvHWX+4U6+p25bR3xOeQgBPB06jegeQ9cdnaCwg3Jra3NPSUfO/ZRQe9TJEW4VVwilXp7v0mwUyqJcK2y5kBNWNZEBnnQaAV+iawzJY19HetwEfzVabFBg3HhgYGx7XFWZYjHTHjwVWsbkjfgBb5461v0CHJjM9jrxfdj1kWIpcxid8O+dUSurKUOY4Hbb6SKXakBTmnkrYs0n3Xg5Ig==&c=AABu3sW2q3Ir8ifQJAijAhNJKq0uXwwF4aGWbgefQqJepVeNmQ2aDLrgth/4e3uZIWGGIQ8D3UPNbSnpgolkZPjCVjLlF8o96RZE6aKBP9hbbWDin7ntLRUM+OO5f3pIO2jZnmZof+ubVBUQEbWFAbo8xkwwPjD2yomWYO9BLauUbPdhe7sTeQubBshJfuD8IakpYR9mWvaRkj7jNE3uduhHnJqo59l67j+0INR7XdqioPPPYIlYt8Y2ErrD/Hm1x7Ub0JlpSy2dIylu82OHsbPe2IgE0AfUZGQlqmZjkJjdk/1R+5UTAbpM4Ru2nPA1W7k8m3b56CPQfp4Nfu7t5KTvxCSLpsyTXBp2H+CLMJgrqBWvScKuAGZzoBftoxN6AlJm7/tBk90HG/fSCigf6L5/vrhdqLwDnA3umOCSZNa6Rd/lq2DBocN9C5i+TM7dwQouAP+UKgVQf4ATMh19VLexy/mmb76HgGZt4HtVGufMb6cC2I7sVZK9dBduwlRzxT47SRfRKthnR5h3xirvQPbRJwRGy1YOGI3PBe6L8zkZnlHm4NWF1riKc7NfDV2jKR/ux1g+p2dIOZSC6QRSQfNi2L0zb9mMJvmZGJpdRbwk09T/RgLB6/6oigEcyMOmQDpPT8ma	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FCBF5826D778A0-C9FF7535?l=AACrcmbDni/ExL+6O84qnOq7s+7FEV7f2cEnFZCBGkVuVLwxJJ9kIF+/XsJvnT/ZZCSNu0ZPkHJMldgNU5hySzD4vbkLFmicZpeb27RRNiBBqzluO2njDgWrhNVOuuG5KecX01qr4Wu4+GPJbk1wcH4NmoDfnECMgEyVdYVJNd9SJ/Z6oeOmLYfmhHtJEcZB1zTo2XcCZUK4o1X55Z6mDqHfXia9/zchVngkbUJFubdOeeGrUXmliV4kA4X0r42Yjp3RKfpMvJU0dvSKL9oGxXQi9sD/MbbP4pxgNW6CajbdZVfsCIontUHWT1eFW4HrQm9NkGaKTegqBxEs/bh3fwfINtkSa08UEhuWP97GhgCO8AMh0qPvYF1Rp7eiHGFkb8QogMMfuDrW2QnTqHRWnTzitTqkjecFMC67nh1FVX/+SWo05+3MmWfzaTxkwp1iAJoDUcmTFcR0WSTfeepWakTIU1exnjYHjHsm9FYU&c=AABJIKCyntddafHrxXwMffbew9PUcwQ56WCR8mvcT/7tDRFoJSRw3QNX02Q/MIVoixgn9dE9sMMP0GDnwqQ0LdLGXfvFaDm4lnRP0nKKMx/K5F9QxPOFroSM5e8+RBG+qqCfBnKxbWihL3/38edMaV7uTv7a0UGb2nVUF+n7XQAl2QSudEpYlV++l35LZxi6JWsnjixzdQpF+bXikFz1oYDN6GSuDb0op6aViO8V/0UhqnTHHddY9/cqyxhVsr874sBNA2avRHpdaXr1CP2PeHJcUgsGQb+Q5ZsuH9DAP++Oq7lFPe0lbuV3tYUIr/YAS6C7DT9Oee2yUkZYYTbI0bVJgmpWHa/G9q/wBFVVHuCTY5U3Rk5FsGRYQV6gWYrnX5DIQf3ZS3CM9xlUC2XMY8/htbCHQHuT5hjcDdzUTL+rWXnJ/TpkKPDyDGmCQh8idvsKAqOWIYWkO3X5LUWuEryoODEKawcYmYfc7zahLtlk7MGx3wWvCKqqkAg6bFwWWKWXURv3AGYvESLycicJVk8PxbBHrVkb/ZjVWsbKsit0CCZTx+7Bs7ZMtFKW5bo+GHe3oXwvXrlQS2IjtYPTG6q1fOR5753mseQVzhjXvKuOJkAQb03nyAw9hJo2vgadjjmOtgB9	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FC1B6DB5BD9241-7C90090F?l=AADy6+7GSFDtie9t8Cg/YUEnWHeQNpQUM5LtDe7UJMsLOceAyoyG1gPOseIEt6wEQOIS0cQG9+43HQOpwin+IcDGpXOmivIAoIj+kjiIGL1D2+8BvnDBEaMAH0f591eHch8eVhYXQMKLzHwgDODg3wt5JqhlbP9RQzflWbxkgz8rcLW9fZi6fO8I2q/H/mufxAmprX0pckYJIlZDOjEWtANKm9qQyuOPBTmTxFfQ7lSnZTWTopfzM4iUzlHH6YHH2Gwf9rOJKxuawJshVk1D6tC4SPWT4Qn+EH36v6noVRG1OVZuyh8POMokxISZrUYw04m/WI9EIj5YnXnJ0pu3aN84TxZoMpQWLf/bmERiIc3Nyv1tTCdvcY5yUV048SjizDEvcSo7xAYIkZcbJD4FxApNB4P7tHx7BM4Ye85I4pWktamhPb27vCl/+uYQPRubCgSnJCgEpm957xU4Pe9/Mw441Bx0a9Cw1g==&c=AAAMLqZiPcHPCafs0rFGm1fIkoNaTXck7ODBjyaeBBJn4WJkh+1bSUuW3EZ3mxfwfU+bqGXZerIBh+MSgUxyjr2dBgbCYcsfxsvjUb8rm3+6Y+MBXQzywIZk3yyBwMGrGcyqAW4sC8CEsQLo0qa26hZf6P5Mds0gAcBhLOQHNHGs04Bz8kP6rN3oyHvKAVKj6q6jh+o5tCfFCSfoFphn1jIlhz58l/iThGupLjhturtvKm1NOX3hQvVyGuodJdqpVFaaDIitHXcYMqB9UmB9x5Je567LlrJzANu3yeDnFlF+FPlEJBxfqHj5MAKq9a5hjcUMFWRj2C1f6q3FTviqfxGBcXqL6mjrfRn2e6SZ3cLMdbrvJF8+K9bEjK0z+DPrn/wowMPNg/sWBhdBb591VOmiiOgz82MQYX1oZvuxWVx8Ss8Y39FUpF/cGTcZLojkZK6/ZSGPHVUwgwezuarqDmRh2tnVahKh1zxiH7oFrg0dqApoWgloHFVuYES+Zx6Fwu8ffg2y+FHXsyJlLjARsT0dR3inuufunKnxFU0f0p8osK+QnybUWCcqfkqTetWNzB5Z8asqQvYhVbUlxqje0VAbhML1S+q4B7u3yifa6/t82x0LbRE1kHeNSO2USFPZmw2CUqF5	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FC1B6DB5BD9241-7C90090F?l=AACK/veH9NDjNFiJHV0SalQi1vBoTxR3+CaR+Tf08xqCc5VCUGXc4X3qdIj9jWGkdCLuES/KY7ELen4EAn/FdnHqCQjbGr4W7dR4kVnBVs6emUveso+FtMlz8WLaK/uswzzWIgI+d66EsmSIAjCn6klItun/LyfhMBm/RvF8+GmEHKuHrtJ8flo99oIsJ0uYTUcGFmrLFZUm12SmxPleHrWwUcLBo1d4hUAo1H1WkirRXbLvtA5AFdQBsGObYvK4Jtgjqj5gw5MW75B9OQ54AcZkBQKcIkmFcg1YL0qDKrf81oJq2UUhMNPl/V/7Lmh2Iy3+rO2Qx71WjGONpPizWLvD7lune8iRYENSNu1xGJst2AqunbtEprrHIRzSb0HY+HbbjV8np3yVIxGt0yN7Vmb5AARDME7dIwHUrmOBP8igeJjkCyNogIrPeE8U4hVHOONDQ0fRseICVU1/ok2ExphS1u92stTGUjMCSci5vEz5fgxKUh8PMHHlxtZQmBjhUQ==&c=AABwK74RGNbpZkLbXDMgwGkEPcjIolhPI3ARymI3akMXqIIsvKkft1xo30+FsOmyglvzbe8Yz6H3Z4LxZ/0aTZFTqxR6u54legvtFlkuV/Y5fZXwm/YmPanR9jUnqtc4hPznzAuUrT6U7sovDeUggzqrrdSH45Gj/uRY+/LazDIdhTbOxXQwN2GEeE643R7hV3n9WYZrcN1rJdKE4J3VridUK5YywIX20BWPmYGQ+iqSfiaJQlNujGzur2PRjzxDNGxHixYHr88wjhccRzzqt63TgH68hxiQWBS2WMJ8V78YgSedyDzugz0SWoHXC4lIoIg/mD4/gfyj8ItwLNrpe3LWbVMyaC3Ad4pEpAUwx2rMNAE2ZRJGw2pFtc10IGwr77FIEYyERoM+q4jxSJoFtK3knGK9ms7DQJFt8w0eTeON/BC9KGyQaC64dCNz+N4+Xs4aPX/XWl9TCa+jzc65pmbZE5Fi0IpF2S9gBcOFdJjQtmI1vA8o1jxGHT+6uixJoZsPaoFWVJAAyljwh/1U0kE7VmRRTmULBXD/WiUTWrHi0xFoOw6OPuSKQtWkN98CCafLvNNkYgEzgEh7ZP0U7YG2Ui/9zjmE3N9hxjTOSgO7rba70M6HBYbc4mR2U37DUGxUEU5C	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FC1B6DB5BD9241-7C90090F?l=AADxL8L+GAtO4/UVYp8MqA+Sj5TSCBAjVAdgXYZk0eblTNDmdbfgDu4l4W8iDoNzLFaNYKheJg76tFPqEuw8bYVS19fwe8hhswMobSAd4H/SzCs2QZVam2WjwmfTSoUPGcyvkpmuq0ISpqIb5vzyWcVKqNTTUTopXpL6xGs6pKvxOLPHunpbWiA5Gm+6TueYrrthSZbOadliaedCA22mM2wTV3gNe1fzC90aFBzTBaHWQxrEXzwRC6Xpb34McFMIrdgz9IrbVcDvXBernticMrVIP1TsiiLBaevE/CbzrdEvKiAf8B42dT0tqManmBttR7OtoRCGhXROd01v21If1UCdSvfYAAn1bVRGaJ9z2t8XAOV+QkM7Cqp/NYaWVJFyc+dA9aHG4frM5s9sjjMhd8DDJlA/xoh8DfH8PxQbhenIpHsjrxicNhJW50U6jm9b5vBU2fBUQmACYkRTG3EArpkHaCcm6XS9GA==&c=AAAYKEKcMSJ1NhQeweljhmaJ+T0baps+PAKT1EF6chohNYEP5R3N/C0hM2VhIOm2Tlt7H1sENRf12adWDrfBHT/6guQroYvA1xotjOsoTnpw56aO6JiaFKlDBMZtdU6YKZE3+4BogcMiYQDvUyAIZDGB062Whj/cCyQvRMUpY4wDddIiNr94Kgc6rYiywX8977La5/XVq66oa1ne7RDSJfRtlqqxgm7XClHOdI3OA0B3qp+/4vc9qgP5m9K6oiTuJ4l3/gwYk0AGIFk70mpjAiufUD44SD2hGTqQBZFJxcidB+zxqyjG/eVcsY6bMPspPna712CUEgXxQWyye0KuqXGZwYCsXaY+GFuBxowOIYKDk88Wtn356Ig9rNqxPX0CvkkgfotUXuPAX4wXqch6/QUpTLyadqx9C4Sc9kx1mpdTeUHzvi6Gp/gANpe6MvHTICJXAKMZKOGh4M+g4DVVhDl13yVrsEhLU2KeP1rJQoSuV0TN//J1ytC9xeA0zXi0gdvfANs0by84UFwBhR1PwHWsOwBbEmjwAuhtE0l27s++Cu1oMhZrefHgxts/MCdJtPjWL98LN1t6aP4/1kw0rhJwk2N1AghWHevFg3v4NeNiBDOA4oRqwpcCL3uBJXOIP2dfK01+	Get hash	malicious	Unknown	Browse	23.227.38.65
	http://servicesopm.com/login.php	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://metaprotradings.com/	Get hash	malicious	Unknown	Browse	104.26.9.183

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_ARC4.pyd	HyZh4pn0RF.exe	Get hash	malicious	Creal Stealer	Browse
	MPX283rT19.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	f2q2w9rTqd.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	LicenseManagerWamp.exe	Get hash	malicious	Unknown	Browse
	PhonexZ.exe	Get hash	malicious	Unknown	Browse
	D07bcK36ed.exe	Get hash	malicious	BLX Stealer, Discord Token Stealer	Browse
	D07bcK36ed.exe	Get hash	malicious	BLX Stealer, Discord Token Stealer	Browse
	ultimateastra.exe	Get hash	malicious	Unknown	Browse
	ultimateastra.exe	Get hash	malicious	Unknown	Browse
	4wx72yFLka.exe	Get hash	malicious	Python Stealer, CStealer, Chaos	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.703513333396807
Encrypted:	false
SSDEEP:	96:nDzb9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDV90OcX6gY/7ECFV:Dzz9damqTrpYTst0E5DVPcqgY/79X
MD5:	6176101B7C377A32C01AE3EDB7FD4DE6
SHA1:	5F1CB443F9D677F313BEC07C5241AEAB57502F5E
SHA-256:	EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB
SHA-512:	3E7373B71AE0834E96A99595CFEF2E96C0F5230429ADC0B5512F4089D1ED0D7F7F0E32A40584DFB13C41D257712A9C4E9722366F0A21B907798AE79D8CEDCF30
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: HyZh4pn0RF.exe, Detection: malicious, Browse Filename: MPX283rT19.exe, Detection: malicious, Browse Filename: f2q2w9rTqd.exe, Detection: malicious, Browse Filename: LicenseManagerWamp.exe, Detection: malicious, Browse Filename: PhonexZ.exe, Detection: malicious, Browse Filename: D07bcK36ed.exe, Detection: malicious, Browse Filename: D07bcK36ed.exe, Detection: malicious, Browse Filename: ultimateastra.exe, Detection: malicious, Browse Filename: ultimateastra.exe, Detection: malicious, Browse Filename: 4wx72yFLka.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.968452734961967
Encrypted:	false
SSDEEP:	96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
MD5:	371776A7E26BAEB3F75C93A8364C9AE0
SHA1:	BF60B2177171BA1C6B4351E6178529D4B082BDA9
SHA-256:	15257E96D1CA8480B8CB98F4C79B6E365FE38A1BA9638FC8C9AB7FFEA79C4762
SHA-512:	C23548FBCD1713C4D8348917FF2AB623C404FB0E9566AB93D147C62E06F51E63BDAA347F2D203FE4F046CE49943B38E3E9FA1433F6455C97379F2BC641AE7CE9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.061461040216793
Encrypted:	false
SSDEEP:	192:ldF/1nb2mhQtkXn0t/WS60YYDEiqvdvGyv9lkVcqgYvEMo:v2f6XSZ6XYD6vdvGyv9MgYvEMo
MD5:	CB5238E2D4149636377F9A1E2AF6DC57
SHA1:	038253BABC9E652BA4A20116886209E2BCCF35AC
SHA-256:	A8D3BB9CD6A78EBDB4F18693E68B659080D08CB537F9630D279EC9F26772EFC7
SHA-512:	B1E6AB509CF1E5ECC6A60455D6900A76514F8DF43F3ABC3B8D36AF59A3DF8A868B489ED0B145D0D799AAC8672CBF5827C503F383D3F38069ABF6056ECCD87B21
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.236167046748013
Encrypted:	false
SSDEEP:	192:/siHXqpoUol3xZhRyQX5lDnRDFYav+tcqgRvE:h6D+XBDgDgRvE
MD5:	D9E7218460AEE693BEA07DA7C2B40177
SHA1:	9264D749748D8C98D35B27BEFE6247DA23FF103D
SHA-256:	38E423D3BCC32EE6730941B19B7D5D8872C0D30D3DD8F9AAE1442CB052C599AD
SHA-512:	DDB579E2DEA9D266254C0D9E23038274D9AE33F0756419FD53EC6DC1A27D1540828EE8F4AD421A5CFFD9B805F1A68F26E70BDC1BAB69834E8ACD6D7BB7BDB0DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........R......U.....R............U......U......U................}.........Rich...........................PE..d....e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..\|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.558176937399355
Encrypted:	false
SSDEEP:	384:Dz2P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuCLg46:DzeqWB7YJlmLJ3oD/S4j990th9VCsC
MD5:	F751792DF10CDEED391D361E82DAF596
SHA1:	3440738AF3C88A4255506B55A673398838B4CEAC
SHA-256:	9524D1DADCD2F2B0190C1B8EDE8E5199706F3D6C19D3FB005809ED4FEBF3E8B5
SHA-512:	6159F245418AB7AD897B02F1AADF1079608E533B9C75006EFAF24717917EAA159846EE5DFC0E85C6CFF8810319EFECBA80C1D51D1F115F00EC1AFF253E312C00
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.285191078037458
Encrypted:	false
SSDEEP:	192:wJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4jqccqgwYUMvEW:ikRwi3wO26Ef+yuIm9PfD7wgwYUMvE
MD5:	BBEA5FFAE18BF0B5679D5C5BCD762D5A
SHA1:	D7C2721795113370377A1C60E5CEF393473F0CC5
SHA-256:	1F4288A098DA3AAC2ADD54E83C8C9F2041EC895263F20576417A92E1E5B421C1
SHA-512:	0932EC5E69696D6DD559C30C19FC5A481BEFA38539013B9541D84499F2B6834A2FFE64A1008A1724E456FF15DDA6268B7B0AD8BA14918E2333567277B3716CC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d....e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.505471888568532
Encrypted:	false
SSDEEP:	192:vd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DW3Q2dhmdcqgwNeecBih:JkP5cjIGpKlqD2D4kzgwNeE
MD5:	D2175300E065347D13211F5BF7581602
SHA1:	3AE92C0B0ECDA1F6B240096A4E68D16D3DB1FFB0
SHA-256:	94556934E3F9EE73C77552D2F3FC369C02D62A4C9E7143E472F8E3EE8C00AEE1
SHA-512:	6156D744800206A431DEE418A1C561FFB45D726DC75467A91D26EE98503B280C6595CDEA02BDA6A023235BD010835EA1FC9CB843E9FEC3501980B47B6B490AF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.06124024160806
Encrypted:	false
SSDEEP:	384:bUv5cJMOZA0nmwBD+XpJgLa0Mp8Qpg4P2llyM:0K1XBD+DgLa1yTi
MD5:	45616B10ABE82D5BB18B9C3AB446E113
SHA1:	91B2C0B0F690AE3ABFD9B0B92A9EA6167049B818
SHA-256:	F348DB1843B8F38A23AEE09DD52FB50D3771361C0D529C9C9E142A251CC1D1EC
SHA-512:	ACEA8C1A3A1FA19034FD913C8BE93D5E273B7719D76CB71C36F510042918EA1D9B44AC84D849570F9508D635B4829D3E10C36A461EC63825BA178F5AC1DE85FB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.475467273446457
Encrypted:	false
SSDEEP:	384:oc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy4IYgLWi:B6H1TZXX5XmrXA+NNxWiFdLWi
MD5:	CF3C2F35C37AA066FA06113839C8A857
SHA1:	39F3B0AEFB771D871A93681B780DA3BD85A6EDD0
SHA-256:	1261783F8881642C3466B96FA5879A492EA9E0DAB41284ED9E4A82E8BCF00C80
SHA-512:	1C36B80AAE49FD5E826E95D83297AE153FDB2BC652A47D853DF31449E99D5C29F42ED82671E2996AF60DCFB862EC5536BB0A68635D4E33D33F8901711C0C8BE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.838534302892255
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
MD5:	20708935FDD89B3EDDEEA27D4D0EA52A
SHA1:	85A9FE2C7C5D97FD02B47327E431D88A1DC865F7
SHA-256:	11DD1B49F70DB23617E84E08E709D4A9C86759D911A24EBDDFB91C414CC7F375
SHA-512:	F28C31B425DC38B5E9AD87B95E8071997E4A6F444608E57867016178CD0CA3E9F73A4B7F2A0A704E45F75B7DCFF54490510C6BF8461F3261F676E9294506D09B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.9047185025862925
Encrypted:	false
SSDEEP:	192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
MD5:	43BBE5D04460BD5847000804234321A6
SHA1:	3CAE8C4982BBD73AF26EB8C6413671425828DBB7
SHA-256:	FAA41385D0DB8D4EE2EE74EE540BC879CF2E884BEE87655FF3C89C8C517EED45
SHA-512:	DBC60F1D11D63BEBBAB3C742FB827EFBDE6DFF3C563AE1703892D5643D5906751DB3815B97CBFB7DA5FCD306017E4A1CDCC0CDD0E61ADF20E0816F9C88FE2C9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.300163691206422
Encrypted:	false
SSDEEP:	192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
MD5:	C6B20332B4814799E643BADFFD8DF2CD
SHA1:	E7DA1C1F09F6EC9A84AF0AB0616AFEA55A58E984
SHA-256:	61C7A532E108F67874EF2E17244358DF19158F6142680F5B21032BA4889AC5D8
SHA-512:	D50C7F67D2DFB268AD4CF18E16159604B6E8A50EA4F0C9137E26619FD7835FAAD323B5F6A2B8E3EC1C023E0678BCBE5D0F867CD711C5CD405BD207212228B2B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..B..B..B..R...B..UC..B.RC..B..C..B..UG..B..UF..B..UA..B..J..B..B..B....B..@..B.Rich.B.........................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.260220483695234
Encrypted:	false
SSDEEP:	384:9XUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZNZY0JAIg+v:99HGHfJidSK
MD5:	0B538205388FDD99A043EE3AFAA074E4
SHA1:	E0DD9306F1DBE78F7F45A94834783E7E886EB70F
SHA-256:	C4769D3E6EB2A2FECB5DEC602D45D3E785C63BB96297268E3ED069CC4A019B1A
SHA-512:	2F4109E42DB7BC72EB50BCCC21EB200095312EA00763A255A38A4E35A77C04607E1DB7BB69A11E1D80532767B20BAA4860C05F52F32BF1C81FE61A7ECCEB35ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	4.276870967324261
Encrypted:	false
SSDEEP:	384:9jUqho9weF5/eHkRnYcZiGKdZHDL7idErZjZYXGg:9RCneH//id42
MD5:	6C3E976AB9F47825A5BD9F73E8DBA74E
SHA1:	4C6EB447FE8F195CF7F4B594CE7EAF928F52B23A
SHA-256:	238CDB6B8FB611DB4626E6D202E125E2C174C8F73AE8A3273B45A0FC18DEA70C
SHA-512:	B19516F00CC0484D9CDA82A482BBFE41635CDBBE19C13F1E63F033C9A68DD36798C44F04D6BD8BAE6523A845E852D81ACADD0D5DD86AF62CC9D081B803F8DF7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.578113904149635
Encrypted:	false
SSDEEP:	96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
MD5:	FEE13D4FB947835DBB62ACA7EAFF44EF
SHA1:	7CC088AB68F90C563D1FE22D5E3C3F9E414EFC04
SHA-256:	3E0D07BBF93E0748B42B1C2550F48F0D81597486038C22548224584AE178A543
SHA-512:	DEA92F935BC710DF6866E89CC6EB5B53FC7ADF0F14F3D381B89D7869590A1B0B1F98F347664F7A19C6078E7AA3EB0F773FFCB711CC4275D0ECD54030D6CF5CB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.143719741413071
Encrypted:	false
SSDEEP:	384:IUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Q90gYP2lXCM:BKR8I+K0lDFQgLa17zU
MD5:	76F88D89643B0E622263AF676A65A8B4
SHA1:	93A365060E98890E06D5C2D61EFBAD12F5D02E06
SHA-256:	605C86145B3018A5E751C6D61FD0F85CF4A9EBF2AD1F3009A4E68CF9F1A63E49
SHA-512:	979B97AAC01633C46C048010FA886EBB09CFDB5520E415F698616987AE850FD342A4210A8DC0FAC1E059599F253565862892171403F5E4F83754D02D2EF3F366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.353267174592179
Encrypted:	false
SSDEEP:	384:7PHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8bg6Vf4A:hPcnB8KSsB34cb+bcOYpMCBDX
MD5:	D48BFFA1AF800F6969CFB356D3F75AA6
SHA1:	2A0D8968D74EBC879A17045EFE86C7FB5C54AEE6
SHA-256:	4AA5E9CE7A76B301766D3ECBB06D2E42C2F09D0743605A91BF83069FEFE3A4DE
SHA-512:	30D14AD8C68B043CC49EAFB460B69E83A15900CB68B4E0CBB379FF5BA260194965EF300EB715308E7211A743FF07FA7F8779E174368DCAA7F704E43068CC4858
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.741247880746506
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
MD5:	4D9182783EF19411EBD9F1F864A2EF2F
SHA1:	DDC9F878B88E7B51B5F68A3F99A0857E362B0361
SHA-256:	C9F4C5FFCDD4F8814F8C07CE532A164AB699AE8CDE737DF02D6ECD7B5DD52DBD
SHA-512:	8F983984F0594C2CAC447E9D75B86D6EC08ED1C789958AFA835B0D1239FD4D7EBE16408D080E7FCE17C379954609A93FC730B11BE6F4A024E7D13D042B27F185
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.212941287344097
Encrypted:	false
SSDEEP:	192:2F/1nb2mhQtkRySMfJ2ycxFzShJD9bAal2QDeJKcqgQx2QY:M2fKRQB2j8JD2fJagQx2QY
MD5:	F4EDB3207E27D5F1ACBBB45AAFCB6D02
SHA1:	8EAB478CA441B8AD7130881B16E5FAD0B119D3F0
SHA-256:	3274F49BE39A996C5E5D27376F46A1039B6333665BB88AF1CA6D37550FA27B29
SHA-512:	7BDEBF9829CB26C010FCE1C69E7580191084BCDA3E2847581D0238AF1CAA87E68D44B052424FDC447434D971BB481047F8F2DA1B1DEF6B18684E79E63C6FBDC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`..........................................9......\|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.181291194389683
Encrypted:	false
SSDEEP:	192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
MD5:	9D28433EA8FFBFE0C2870FEDA025F519
SHA1:	4CC5CF74114D67934D346BB39CA76F01F7ACC3E2
SHA-256:	FC296145AE46A11C472F99C5BE317E77C840C2430FBB955CE3F913408A046284
SHA-512:	66B4D00100D4143EA72A3F603FB193AFA6FD4EFB5A74D0D17A206B5EF825E4CC5AF175F5FB5C40C022BDE676BA7A83087CB95C9F57E701CA4E7F0A2FCE76E599
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.140195114409974
Encrypted:	false
SSDEEP:	192:RsiHXqpo0cUp8XnUp8XjEQnlDtJI6rcqgcx2:f6DcUp8XUp8AclDA69gcx2
MD5:	8A92EE2B0D15FFDCBEB7F275154E9286
SHA1:	FA9214C8BBF76A00777DFE177398B5F52C3D972D
SHA-256:	8326AE6AD197B5586222AFA581DF5FE0220A86A875A5E116CB3828E785FBF5C2
SHA-512:	7BA71C37AAF6CB10FC5C595D957EB2846032543626DE740B50D7CB954FF910DCF7CEAA56EB161BAB9CC1F663BADA6CA71973E6570BAC7D6DA4D4CC9ED7C6C3DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.203867759982304
Encrypted:	false
SSDEEP:	192:WsiHXqpwUiv6wPf+4WVrd1DFrCqwWwcqgfvE:s6biio2Pd1DFmlgfvE
MD5:	FE16E1D12CF400448E1BE3FCF2D7BB46
SHA1:	81D9F7A2C6540F17E11EFE3920481919965461BA
SHA-256:	ADE1735800D9E82B787482CCDB0FBFBA949E1751C2005DCAE43B0C9046FE096F
SHA-512:	A0463FF822796A6C6FF3ACEBC4C5F7BA28E7A81E06A3C3E46A0882F536D656D3F8BAF6FB748008E27F255FE0F61E85257626010543FC8A45A1E380206E48F07C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.478301937972917
Encrypted:	false
SSDEEP:	192:hZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZkRsP0rcqgjPrvE:8Q0gH7zSccA5J6ECTGmDua89gjPrvE
MD5:	34EBB5D4A90B5A39C5E1D87F61AE96CB
SHA1:	25EE80CC1E647209F658AEBA5841F11F86F23C4E
SHA-256:	4FC70CB9280E414855DA2C7E0573096404031987C24CF60822854EAA3757C593
SHA-512:	82E27044FD53A7309ABAECA06C077A43EB075ADF1EF0898609F3D9F42396E0A1FA4FFD5A64D944705BBC1B1EBB8C2055D8A420807693CC5B70E88AB292DF81B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.69608744353984
Encrypted:	false
SSDEEP:	384:nkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+DSngkov:onx7RI26LuuHKz8+DbN
MD5:	42C2F4F520BA48779BD9D4B33CD586B9
SHA1:	9A1D6FFA30DCA5CE6D70EAC5014739E21A99F6D8
SHA-256:	2C6867E88C5D3A83D62692D24F29624063FCE57F600483BAD6A84684FF22F035
SHA-512:	1F0C18E1829A5BAE4A40C92BA7F8422D5FE8DBE582F7193ACEC4556B4E0593C898956065F398ACB34014542FCB3365DC6D4DA9CE15CB7C292C8A2F55FB48BB2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.7981108922569735
Encrypted:	false
SSDEEP:	384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
MD5:	AB0BCB36419EA87D827E770A080364F6
SHA1:	6D398F48338FB017AACD00AE188606EB9E99E830
SHA-256:	A927548ABEA335E6BCB4A9EE0A949749C9E4AA8F8AAD481CF63E3AC99B25A725
SHA-512:	3580FB949ACEE709836C36688457908C43860E68A36D3410F3FA9E17C6A66C1CDD7C081102468E4E92E5F42A0A802470E8F4D376DAA4ED7126818538E0BD0BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.865452719694432
Encrypted:	false
SSDEEP:	384:y1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOcwgjxo:QjwyJUYToZwOLuzDNB1j
MD5:	C8FE3FF9C116DB211361FBB3EA092D33
SHA1:	180253462DD59C5132FBCCC8428DEA1980720D26
SHA-256:	25771E53CFECB5462C0D4F05F7CAE6A513A6843DB2D798D6937E39BA4B260765
SHA-512:	16826BF93C8FA33E0B5A2B088FB8852A2460E0A02D699922A39D8EB2A086E981B5ACA2B085F7A7DA21906017C81F4D196B425978A10F44402C5DB44B2BF4D00A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.867732744112887
Encrypted:	false
SSDEEP:	384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
MD5:	A442EA85E6F9627501D947BE3C48A9DD
SHA1:	D2DEC6E1BE3B221E8D4910546AD84FE7C88A524D
SHA-256:	3DBCB4D0070BE355E0406E6B6C3E4CE58647F06E8650E1AB056E1D538B52B3D3
SHA-512:	850A00C7069FFDBA1EFE1324405DA747D7BD3BA5D4E724D08A2450B5A5F15A69A0D3EAF67CEF943F624D52A4E2159A9F7BDAEAFDC6C689EACEA9987414250F3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.860044313282322
Encrypted:	false
SSDEEP:	384:xFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDXfgjVx2:jDLh98jjRe+1WT1aAeIfMzxH2mDDIj
MD5:	59BA0E05BE85F48688316EE4936421EA
SHA1:	1198893F5916E42143C0B0F85872338E4BE2DA06
SHA-256:	C181F30332F87FEECBF930538E5BDBCA09089A2833E8A088C3B9F3304B864968
SHA-512:	D772042D35248D25DB70324476021FB4303EF8A0F61C66E7DED490735A1CC367C2A05D7A4B11A2A68D7C34427971F96FF7658D880E946C31C17008B769E3B12F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.917025846093607
Encrypted:	false
SSDEEP:	384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXwElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXD+j
MD5:	8194D160FB215498A59F850DC5C9964C
SHA1:	D255E8CCBCE663EE5CFD3E1C35548D93BFBBFCC0
SHA-256:	55DEFCD528207D4006D54B656FD4798977BD1AAE6103D4D082A11E0EB6900B08
SHA-512:	969EEAA754519A58C352C24841852CF0E66C8A1ADBA9A50F6F659DC48C3000627503DDFB7522DA2DA48C301E439892DE9188BF94EEAF1AE211742E48204C5E42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.999870226643325
Encrypted:	false
SSDEEP:	192:DzFRF/1nb2mhQtk4axusjfkgZhoYDQgRjcqgQvEty:DzFd2f64axnTTz5D1gQvEty
MD5:	C89BECC2BECD40934FE78FCC0D74D941
SHA1:	D04680DF546E2D8A86F60F022544DB181F409C50
SHA-256:	E5B6E58D6DA8DB36B0673539F0C65C80B071A925D2246C42C54E9FCDD8CA08E3
SHA-512:	715B3F69933841BAADC1C30D616DB34E6959FD9257D65E31C39CD08C53AFA5653B0E87B41DCC3C5E73E57387A1E7E72C0A668578BD42D5561F4105055F02993C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.025153056783597
Encrypted:	false
SSDEEP:	192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
MD5:	C4CC05D3132FDFB05089F42364FC74D2
SHA1:	DA7A1AE5D93839577BBD25952A1672C831BC4F29
SHA-256:	8F3D92DE840ABB5A46015A8FF618FF411C73009CBAA448AC268A5C619CF84721
SHA-512:	C597C70B7AF8E77BEEEBF10C32B34C37F25C741991581D67CF22E0778F262E463C0F64AA37F92FBC4415FE675673F3F92544E109E5032E488F185F1CFBC839FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.235115741550938
Encrypted:	false
SSDEEP:	192:XTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDhgvrjcqgCieT3WQ:XafgNpj9cHW3jqXeBRamDOZgCieT
MD5:	1E201DF4B4C8A8CD9DA1514C6C21D1C4
SHA1:	3DC8A9C20313AF189A3FFA51A2EAA1599586E1B2
SHA-256:	A428372185B72C90BE61AC45224133C4AF6AE6682C590B9A3968A757C0ABD6B4
SHA-512:	19232771D4EE3011938BA2A52FA8C32E00402055038B5EDF3DDB4C8691FA7AE751A1DC16766D777A41981B7C27B14E9C1AD6EBDA7FFE1B390205D0110546EE29
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.133714807569085
Encrypted:	false
SSDEEP:	192:JZNGXEgvUh43G6coX2SSwmPL4V7wTdDlpaY2cqgWjvE:EVMhuGGF2L4STdDyYWgWjvE
MD5:	76C84B62982843367C5F5D41B550825F
SHA1:	B6DE9B9BD0E2C84398EA89365E9F6D744836E03A
SHA-256:	EBCD946F1C432F93F396498A05BF07CC77EE8A74CE9C1A283BF9E23CA8618A4C
SHA-512:	03F8BB1D0D63BF26D8A6FFF62E94B85FFB4EA1857EB216A4DEB71C806CDE107BA0F9CC7017E3779489C5CEF5F0838EDB1D70F710BCDEB629364FC288794E6AFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..\|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.928082706906375
Encrypted:	false
SSDEEP:	768:8bEkzS7+k9rMUb8cOe9rs9ja+V/Mhjh56GS:8bEP779rMtcOCs0I/Mhf
MD5:	B41160CF884B9E846B890E0645730834
SHA1:	A0F35613839A0F8F4A87506CD59200CCC3C09237
SHA-256:	48F296CCACE3878DE1148074510BD8D554A120CAFEF2D52C847E05EF7664FFC6
SHA-512:	F4D57351A627DD379D56C80DA035195292264F49DC94E597AA6638DF5F4CF69601F72CC64FC3C29C5CBE95D72326395C5C6F4938B7895C69A8D839654CFC8F26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..\|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.799063285091512
Encrypted:	false
SSDEEP:	192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
MD5:	BA46602B59FCF8B01ABB135F1534D618
SHA1:	EFF5608E05639A17B08DCA5F9317E138BEF347B5
SHA-256:	B1BAB0E04AC60D1E7917621B03A8C72D1ED1F0251334E9FA12A8A1AC1F516529
SHA-512:	A5E2771623DA697D8EA2E3212FBDDE4E19B4A12982A689D42B351B244EFBA7EFA158E2ED1A2B5BC426A6F143E7DB810BA5542017AB09B5912B3ECC091F705C6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754688
Entropy (8bit):	7.624959985050181
Encrypted:	false
SSDEEP:	12288:I1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h9:gYmzHoxJFf1p34hcrn5Go9yQO6L
MD5:	3F20627FDED2CF90E366B48EDF031178
SHA1:	00CED7CD274EFB217975457906625B1B1DA9EBDF
SHA-256:	E36242855879D71AC57FBD42BB4AE29C6D80B056F57B18CEE0B6B1C0E8D2CF57
SHA-512:	05DE7C74592B925BB6D37528FC59452C152E0DCFC1D390EA1C48C057403A419E5BE40330B2C5D5657FEA91E05F6B96470DDDF9D84FF05B9FD4192F73D460093C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d....e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.792654050660321
Encrypted:	false
SSDEEP:	384:hBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsia15gkbQ0e1:/L/g28Ufsxg9GmvPauYLxtX1D/kf
MD5:	290D936C1E0544B6EC98F031C8C2E9A3
SHA1:	CAEEA607F2D9352DD605B6A5B13A0C0CB1EA26EC
SHA-256:	8B00C859E36CBCE3EC19F18FA35E3A29B79DE54DA6030AAAD220AD766EDCDF0A
SHA-512:	F08B67B633D3A3F57F1183950390A35BF73B384855EAAB3AE895101FBC07BCC4990886F8DE657635AD528D6C861BC2793999857472A5307FFAA963AA6685D7E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d....e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	6.060461288575063
Encrypted:	false
SSDEEP:	1536:nqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRLpq:nqctkGACFI5t35q2JbgrwwOoqLTM9rMh
MD5:	5782081B2A6F0A3C6B200869B89C7F7D
SHA1:	0D4E113FB52FE1923FE05CDF2AB9A4A9ABEFC42E
SHA-256:	E72E06C721DD617140EDEBADD866A91CF97F7215CBB732ECBEEA42C208931F49
SHA-512:	F7FD695E093EDE26FCFD0EE45ADB49D841538EB9DAAE5B0812F29F0C942FB13762E352C2255F5DB8911F10FA1B6749755B51AAE1C43D8DF06F1D10DE5E603706
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\PublicKey\_x25519.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.488437566846231
Encrypted:	false
SSDEEP:	96:tpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADwhDTAbcX6gn/7EC:5VddiT7pgTctdErDwDTicqgn/7
MD5:	289EBF8B1A4F3A12614CFA1399250D3A
SHA1:	66C05F77D814424B9509DD828111D93BC9FA9811
SHA-256:	79AC6F73C71CA8FDA442A42A116A34C62802F0F7E17729182899327971CFEB23
SHA-512:	4B95A210C9A4539332E2FB894D7DE4E1B34894876CCD06EEC5B0FC6F6E47DE75C0E298CF2F3B5832C9E028861A53B8C8E8A172A3BE3EC29A2C9E346642412138
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d....e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.730605326965181
Encrypted:	false
SSDEEP:	96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
MD5:	4D9C33AE53B38A9494B6FBFA3491149E
SHA1:	1A069E277B7E90A3AB0DCDEE1FE244632C9C3BE4
SHA-256:	0828CAD4D742D97888D3DFCE59E82369317847651BBA0F166023CB8ACA790B2B
SHA-512:	BDFBF29198A0C7ED69204BF9E9B6174EBB9E3BEE297DD1EB8EB9EA6D7CAF1CC5E076F7B44893E58CCF3D0958F5E3BDEE12BD090714BEB5889836EE6F12F0F49E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`..........................................'..\|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.685843290341897
Encrypted:	false
SSDEEP:	96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
MD5:	8F4313755F65509357E281744941BD36
SHA1:	2AAF3F89E56EC6731B2A5FA40A2FE69B751EAFC0
SHA-256:	70D90DDF87A9608699BE6BBEDF89AD469632FD0ADC20A69DA07618596D443639
SHA-512:	FED2B1007E31D73F18605FB164FEE5B46034155AB5BB7FE9B255241CFA75FF0E39749200EB47A9AB1380D9F36F51AFBA45490979AB7D112F4D673A0C67899EF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49528
Entropy (8bit):	6.662491747506177
Encrypted:	false
SSDEEP:	768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5:	F8DFA78045620CF8A732E67D1B1EB53D
SHA1:	FF9A604D8C99405BFDBBF4295825D3FCBC792704
SHA-256:	A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
SHA-512:	BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71448
Entropy (8bit):	6.263206909105092
Encrypted:	false
SSDEEP:	1536:BoxWhy9EQkTpR1Pg9qgTILN/86wW1lI1Onl7SyPxN3:BiWhy3k1Ra9qgTILN/Lw8lI1OnlB
MD5:	CC0F232F2A8A359DEE29A573667E6D77
SHA1:	D3FFBF5606D9C77A0DE0B7456F7A5314F420B1F7
SHA-256:	7A5C88CE496BAFDF31A94AE6D70B017070703BC0A7DA1DFAE7C12B21BB61030D
SHA-512:	48484177BF55179607D66F5A5837A35CD586E8A9FB185DE8B10865AAB650B056A61D1DC96370C5EFC6955CCB4E34B31810F8E1C8F5F02D268F565A73B4FF5657
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7_[.V1..V1..V1......V1.5.0..V1.5.2..V1.5.5..V1.5.4..V1...0..V1...0..V1..V0.qV1...<..V1...1..V1......V1...3..V1.Rich.V1.........................PE..d.....f.........." ...(.f................................................... ............`.............................................P......d......................../..............T...........................@...@............................................text...]e.......f.................. ..`.rdata..pO.......P...j..............@..@.data...p...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85272
Entropy (8bit):	6.591457260071925
Encrypted:	false
SSDEEP:	1536:+yhz79151BVo1vXfzIFnaR4bO1AsCn8Bsjk+tI1CVQ7Sy4x+R:Nhzx15evXkuxAB8BMk+tI1CVQF
MD5:	DD26ED92888DE9C57660A7AD631BB916
SHA1:	77D479D44D9E04F0A1355569332233459B69A154
SHA-256:	324268786921EC940CBD4B5E2F71DAFD08E578A12E373A715658527E5B211697
SHA-512:	D693367565005C1B87823E781DC5925146512182C8D8A3A2201E712C88DF1C0E66E65ECAEC9AF22037F0A8F8B3FB3F511EA47CFD5774651D71673FAB612D2897
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b....(......(......(......(......(.....................................................Rich...........PE..d......f.........." ...(.....^...............................................`............`.........................................p...H............@.......0..D......../...P..........T...........................p...@............................................text...#........................... ..`.rdata..P>.......@..................@..@.data........ ......................@....pdata..D....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_cffi_backend.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182784
Entropy (8bit):	6.193615170968096
Encrypted:	false
SSDEEP:	3072:YRAMUp3K6YoDssyudy4VcRG+nR3hnW3mjwwOdkS9S7iSSTLkK/jftw3buz:Y6MyK65ssy+MG+LnSUwjD9zSSTLL/jl8
MD5:	0572B13646141D0B1A5718E35549577C
SHA1:	EEB40363C1F456C1C612D3C7E4923210EAE4CDF7
SHA-256:	D8A76D1E31BBD62A482DEA9115FC1A109CB39AF4CF6D1323409175F3C93113A7
SHA-512:	67C28432CA8B389ACC26E47EB8C4977FDDD4AF9214819F89DF07FECBC8ED750D5F35807A1B195508DD1D77E2A7A9D7265049DCFBFE7665A7FD1BA45DA1E4E842
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I.C.I.C.I.C.1MC.I.C.<.B.I.C.&#C.I.C.<.B.I.C.<.B.I.C.<.B.I.C.1.B.I.C.4.B.I.C.I.C I.C.<.B.I.C.1KC.I.C.<.B.I.C.<!C.I.C.<.B.I.CRich.I.C................PE..d...g..e.........." .........@......`........................................@............`..........................................w..l....w....... ..........l............0.......]...............................]..8............................................text............................... ..`.rdata..............................@..@.data...h].......0...\|..............@....pdata..l...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.138116508461042
Encrypted:	false
SSDEEP:	3072:cXw32spTVYgFoj6N2xE9sb7VRf/EiZBq5syCtYPU9BI1LP885:cgGEOgFoj68ksrf/Ejsa5
MD5:	C8AFA1EBB28828E1115C110313D2A810
SHA1:	1D0D28799A5DBE313B6F4DDFDB7986D2902FA97A
SHA-256:	8978972CF341CCD0EDF8435D63909A739DF7EF29EC7DD57ED5CAB64B342891F0
SHA-512:	4D9F41BD23B62600D1EB097D1578BA656B5E13FD2F31EF74202AA511111969BB8CFC2A8E903DE73BD6E63FADAA59B078714885B8C5B8ECC5C4128FF9D06C1E56
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......f.d."..."..."...+...$....... .......&.......*...........7... ...i...#...i...$.......!..."......7...$...7...#...7...#...7...#...Rich"...........................PE..d....f.........." ...(............`_..............................................\|.....`.........................................p`.......`.........................../......t.......T...............................@............................................text............................... ..`.rdata..hl.......n..................@..@.data...,5.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	257304
Entropy (8bit):	6.565090204799859
Encrypted:	false
SSDEEP:	6144:3uQjqbJrTwvqM+eYx+lDJOAkl9qWM53pLW1AcfRRR6tlISgOg:3sTwvWeS+xJw4ln7g
MD5:	CEA3B419C7CA87140A157629C6DBD299
SHA1:	7DBFF775235B1937B150AE70302B3208833DC9BE
SHA-256:	95B9850E6FB335B235589DD1348E007507C6B28E332C9ABB111F2A0035C358E5
SHA-512:	6E3A6781C0F05BB5182073CCA1E69B6DF55F05FF7CDCEA394BACF50F88605E2241B7387F1D8BA9F40A96832D04F55EDB80003F0CF1E537A26F99408EE9312F5B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............'.....g&......g&......g&......g&.......!.................9....!.......!.......!.......!K......!......Rich............PE..d.....f.........." ...(.....<............................................................`..........................................c..P....c...................&......./......T.......T...........................p...@............................................text...9........................... ..`.rdata..(...........................@..@.data...X*.......$...b..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66328
Entropy (8bit):	6.227566291152438
Encrypted:	false
SSDEEP:	1536:/9gLpgE4Z27ARZWZnEmoAlI1OIH7SyT0xq:26RZeEmoAlI1OIHth
MD5:	D19CB5CA144AE1FD29B6395B0225CF40
SHA1:	5B9EC6E656261CE179DFCFD5C6A3CFE07C2DFEB4
SHA-256:	F95EC2562A3C70FB1A6E44D72F4223CE3C7A0F0038159D09DCE629F59591D5AA
SHA-512:	9AC3A8A4DBDB09BE3760E7CCB11269F82A47B24C03D10D289BCDDED9A43E57D3CD656F8D060D66B810382ECAC3A62F101F83EA626B58CD0B5A3CCA25B67B1519
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........N@.. ... ... ...... ..k!... ..k#... ..k$... ..k%... ..l!... ...!... ..h!... ...!.Y. ..l-... ..l ... ..l.... ..l"... .Rich.. .........................PE..d......f.........." ...(.V.......... @............................................../.....`.........................................p...P................................/......X...@}..T............................\|..@............p..(............................text....T.......V.................. ..`.rdata...O...p...P...Z..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	160024
Entropy (8bit):	6.85368707809341
Encrypted:	false
SSDEEP:	3072:lsvkxujgo7e2uONOG+hi+C8znfF9mNooXnmbutI1Z1mb:lnu0o7JUrNYOo2Kz
MD5:	8CFBAFE65D6E38DDE8E2E8006B66BB3E
SHA1:	CB63ADDD102E47C777D55753C00C29C547E2243C
SHA-256:	6D548DB0AB73291F82CF0F4CA9EC0C81460185319C8965E829FAEACAE19444FF
SHA-512:	FA021615D5C080AADCD5B84FD221900054EB763A7AF8638F70CF6CD49BD92773074F1AC6884F3CE1D8A15D59439F554381377FAEE4842ED5BEB13FF3E1B510F4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.3H%.`H%.`H%.`A]7`L%.`...aJ%.`...aK%.`...a@%.`...aD%.`]..aK%.`.].aJ%.`H%.`-%.`]..ar%.`]..aI%.`].[`I%.`]..aI%.`RichH%.`........................PE..d......f.........." ...(.f..........`8....................................................`......................................... %..L...l%..x....p.......P.......B.../......4.......T...............................@............................................text...be.......f.................. ..`.rdata..............j..............@..@.data...p....@......................@....pdata.......P......."..............@..@.rsrc........p.......6..............@..@.reloc..4............@..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35608
Entropy (8bit):	6.432025225087344
Encrypted:	false
SSDEEP:	768:a1Rp7eiajKCWnAxQ0zduVI1Wt95YiSyvAAMxkE3:mRteiaoAxQ0zIVI1Wtj7SyGxr
MD5:	EB859FC7F54CBA118A321440AD088096
SHA1:	9D3C410240F4C5269E07FFBDE43D6F5E7CC30B44
SHA-256:	14BDD15D60B9D6141009AEEDC606007C42B46C779A523D21758E57CF126DC2A4
SHA-512:	694A9C1CC3DC78B47FAEDF66248FF078E5090CFAB22E95C123FB99B10192A5748748A5F0937FFD9FD8E1873AD48F290BE723FE194B7EB2A731ADD7F5FB776C4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.A)../z../z../z..z../z.$.{../z.$,{../z.$+{../z.$*{../z.#.{../z...zr./z[..{../z.#"{../z.#/{../z.#.z../z.#-{../zRich../z........PE..d.....f.........." ...(. ...>......@................................................J....`.........................................@E..`....E..x............p.......\.../...........4..T............................3..@............0...............................text............ .................. ..`.rdata... ...0..."...$..............@..@.data...`....`.......F..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56088
Entropy (8bit):	6.331247108655531
Encrypted:	false
SSDEEP:	1536:Minr44gaZPXxCJ/+yZdDDr5I1Xtw7Sy+xmS2:M3J/+yZdDDr5I1Xtwf
MD5:	DF92EA698A3D0729B70A4306BBE3029F
SHA1:	B82F3A43568148C64A46E2774AEC39BF1F2D3C1E
SHA-256:	46DEC978EC8CB2146854739BFEDDEA93335DCC92A25D719352B94F9517855032
SHA-512:	BDEBAFE1B40244A0CB6C97E75424F79CFE395774A9D03CDB02F82083110C1F4BDCAC2819BA1845AD1C56E2D2E6506DCC1833E4EB269BB0F620F0EB73B4D47817
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.{X..(X..(X..(QxT(\..(...)Z..(...)[..(...)P..(...)T..(M..)Z..(X..(/..(.x.)]..(.x.)Y..(M..)Y..(M..)Y..(M.8(Y..(M..)Y..(RichX..(........PE..d.....f.........." ...(.N...`.......................................................M....`.............................................X.............................../......(....f..T............................e..@............`...............................text...7L.......N.................. ..`.rdata...8...`...:...R..............@..@.data...0...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.552970921547832
Encrypted:	false
SSDEEP:	768:1lzRmezd6rGjMoW4BI1QUGL5YiSyv8+WAMxkEW7:LRm0MGooW4BI1QUG17SyIxC7
MD5:	7D91DD8E5F1DBC3058EA399F5F31C1E6
SHA1:	B983653B9F2DF66E721ECE95F086C2F933D303FC
SHA-256:	76BBA42B1392DC57A867AEF385B990FA302A4F1DCF453705AC119C9C98A36E8D
SHA-512:	B8E7369DA79255A4BB2ED91BA0C313B4578EE45C94E6BC74582FC14F8B2984ED8FCDA0434A5BD3B72EA704E6E8FD8CBF1901F325E774475E4F28961483D6C7CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.\.V...V...V...."..V..5...V..5...V..5...V..5...V......V.......V...V...V......V......V....N..V......V..Rich.V..........................PE..d.....f.........." ...(.....8.......................................................x....`..........................................C..L...<D..d....p.......`.......P.../...........4..T...........................@3..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.31969940395018
Encrypted:	false
SSDEEP:	1536:COYhekrkJqlerLSyypHi9/s+S+pzjii/n1IsJqKNBI1Lw9PD7Sy9duxJ:jwkJqHyypHi9/sT+pzjiE1IwdNBI1LwU
MD5:	E43AED7D6A8BCD9DDFC59C2D1A2C4B02
SHA1:	36F367F68FB9868412246725B604B27B5019D747
SHA-256:	2C2A6A6BA360E38F0C2B5A53B4626F833A3111844D95615EBF35BE0E76B1EF7A
SHA-512:	D92E26EB88DB891DE389A464F850A8DA0A39AF8A4D86D9894768CB97182B8351817CE14FE1EB8301B18B80D1D5D8876A48BA66EB7B874C7C3D7B009FCDBC8C4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}g.c\|.Nb}g.a\|.Nb}g.f\|.Nb}g.g\|.Nb}..c\|.Nb}.Nc}.Nb}.6c\|.Nb}..o\|.Nb}..b\|.Nb}..}.Nb}..`\|.Nb}Rich.Nb}................PE..d......f.........." ...(.x..........0-.......................................`......@.....`.........................................@...P............@.......0.........../...P......P...T...............................@............................................text....v.......x.................. ..`.rdata...x.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.261856601346184
Encrypted:	false
SSDEEP:	3072:qWdTrLGXVx7Qt+HEGGCO4w5yVrrPrrrrrrbEOyfgv/pWwb8lI1OQaX9:jAVxMt7YC5yrWgHos8X
MD5:	F8869058C1F6F6352309D774C0FEFDE9
SHA1:	4A9FD6C93785C6B6C53F33946E9B1CA5DB52A4E9
SHA-256:	FB00951D39084E88871C813D6C4043CE8AFB60AB6D012E699DDD607BAA10F6E1
SHA-512:	37205B755985CDBB16F806CDA8E7637164D1D62F410EA07501739215B9E410E91997110600EAD999D726CB15EC4AEF3ABF673E7AD47D3CA076457C89EA2B401C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M..#..#..#.....#..1"..#..1..#..1 ..#..1'...#..1&..#..6"..#..."..#.."..#..6....#..6#..#..6..#..6!..#.Rich.#.........................PE..d......f.........." ...(.................................................................`.........................................@o..P....o..................D......../.......... ...T...............................@............................................text...X........................... ..`.rdata..b...........................@..@.data................~..............@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178456
Entropy (8bit):	5.974570300962832
Encrypted:	false
SSDEEP:	3072:ZmkiCZfBmvD1ZLnM2Yfp6XSVJLX2GvMf1ba+VRJNI7IM/H9o/PCrXuI3JtI1C7lD:xiC5QD1dwp6XSxMfjTwJxd
MD5:	6A2B0F8F50B47D05F96DEFF7883C1270
SHA1:	2B1AEB6FE9A12E0D527B042512FC8890EEDB10D8
SHA-256:	68DAD60FF6FB36C88EF1C47D1855517BFE8DE0F5DDEA0F630B65B622A645D53A
SHA-512:	A080190D4E7E1ABB186776AE6E83DAB4B21A77093A88FCA59CE1F63C683F549A28D094818A0EE44186DDEA2095111F1879008C0D631FC4A8D69DD596EF76CA37
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^..`...`...`......`./ia...`./ic...`./id...`./ie...`..na...`..ja...`...a.u.`...a...`..nm...`..n`...`..n....`..nb...`.Rich..`.........PE..d......f.........." ...(.............,....................................................`.............................................d...D...................P......../......x.......T...........................@...@............................................text............................... ..`.rdata...#.......$..................@..@.data...p...........................@....pdata..P............b..............@..@.rsrc................n..............@..@.reloc..x............x..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37656
Entropy (8bit):	6.341257574556273
Encrypted:	false
SSDEEP:	768:r/mqQhTcYsjNxO0tI1Ci75YiSyvNhAMxkE9x2:Dm7GFNxO0tI1CiF7SynxRI
MD5:	BED7B0CED98FA065A9B8FE62E328713F
SHA1:	E329EBCA2DF8889B78CE666E3FB909B4690D2DAA
SHA-256:	5818679010BB536A3D463EEEE8CE203E880A8CD1C06BF1CB6C416AB0DC024D94
SHA-512:	C95F7BB6CA9AFBA50BF0727E971DFF7326CE0E23A4BFA44D62F2ED67ED5FEDE1B018519DBFA0ED3091D485ED0ACE68B52DD0BB2921C9C1E3BC1FA875CD3D2366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.L...L...L...E..J.......H.......H.......D...Y...N.......Q.......K...L...........M...Y...M...Y...M...Y...M...Y...M...RichL...........PE..d....f.........." ...(....<.......(..............................................@.....`..........................................V..H...HV..................x....d.../......t...dG..T............................C..@............@.......S..@....................text...n(......................... ..`.rdata..4 ...@..."..................@..@.data........p.......P..............@....pdata..x............T..............@..@.rsrc................X..............@..@.reloc..t............b..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22112
Entropy (8bit):	4.744270711412692
Encrypted:	false
SSDEEP:	192:zFOhcWqhWpvWEXCVWQ4iWwklRxwVIX01k9z3AROVaz4ILS:zFlWqhWpk6R9zeU0J2
MD5:	E8B9D74BFD1F6D1CC1D99B24F44DA796
SHA1:	A312CFC6A7ED7BF1B786E5B3FD842A7EEB683452
SHA-256:	B1B3FD40AB437A43C8DB4994CCFFC7F88000CC8BB6E34A2BCBFF8E2464930C59
SHA-512:	B74D9B12B69DB81A96FC5A001FD88C1E62EE8299BA435E242C5CB2CE446740ED3D8A623E1924C2BC07BFD9AEF7B2577C9EC8264E53E5BE625F4379119BAFCC27
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....dZ..........." .........0...............................................@............`A........................................p...,............0...............0..`&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.602255667966723
Encrypted:	false
SSDEEP:	192:NWqhWEWEXCVWQ4cRWvBQrVXC4dlgX01k9z3AUj7W6SxtR:NWqhWPlZVXC4deR9zVj7QR
MD5:	CFE0C1DFDE224EA5FED9BD5FF778A6E0
SHA1:	5150E7EDD1293E29D2E4D6BB68067374B8A07CE6
SHA-256:	0D0F80CBF476AF5B1C9FD3775E086ED0DFDB510CD0CC208EC1CCB04572396E3E
SHA-512:	B0E02E1F19CFA7DE3693D4D63E404BDB9D15527AC85A6D492DB1128BB695BFFD11BEC33D32F317A7615CB9A820CD14F9F8B182469D65AF2430FFCDBAD4BD7000
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....N7.........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.606873381830854
Encrypted:	false
SSDEEP:	192:T0WqhWnWEXCVWQ4mW5ocADB6ZX01k9z3AkprGvV:T0WqhW8VcTR9zJpr4V
MD5:	33BBECE432F8DA57F17BF2E396EBAA58
SHA1:	890DF2DDDFDF3EECCC698312D32407F3E2EC7EB1
SHA-256:	7CF0944901F7F7E0D0B9AD62753FC2FE380461B1CCE8CDC7E9C9867C980E3B0E
SHA-512:	619B684E83546D97FC1D1BC7181AD09C083E880629726EE3AF138A9E4791A6DCF675A8DF65DC20EDBE6465B5F4EAC92A64265DF37E53A5F34F6BE93A5C2A7AE5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....IL..........." .........0...............................................@...........`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.65169290018864
Encrypted:	false
SSDEEP:	192:qzmxD3T4qLWqhW2WJWadJCsVWQ4mW/xNVAv+cQ0GX01k9z3ARoanSwT44:qzQVWqhWTCsiNbZR9zQoUSwTJ
MD5:	EB0978A9213E7F6FDD63B2967F02D999
SHA1:	9833F4134F7AC4766991C918AECE900ACFBF969F
SHA-256:	AB25A1FE836FC68BCB199F1FE565C27D26AF0C390A38DA158E0D8815EFE1103E
SHA-512:	6F268148F959693EE213DB7D3DB136B8E3AD1F80267D8CBD7D5429C021ADACCC9C14424C09D527E181B9C9B5EA41765AFF568B9630E4EB83BFC532E56DFE5B63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..H...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26216
Entropy (8bit):	4.866487428274293
Encrypted:	false
SSDEEP:	192:gaNYPvVX8rFTsCWqhWVWEXCVWQ4mWPJlBLrp0KBQfX01k9z3ALkBw:WPvVX8WqhWiyBRxB+R9z2kBw
MD5:	EFAD0EE0136532E8E8402770A64C71F9
SHA1:	CDA3774FE9781400792D8605869F4E6B08153E55
SHA-256:	3D2C55902385381869DB850B526261DDEB4628B83E690A32B67D2E0936B2C6ED
SHA-512:	69D25EDF0F4C8AC5D77CB5815DFB53EAC7F403DC8D11BFE336A545C19A19FFDE1031FA59019507D119E4570DA0D79B95351EAC697F46024B4E558A0FF6349852
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....(............" .........@...............................................P......z.....`A........................................p................@...............@..h&..............p............................................................................rdata..\|........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.619913450163593
Encrypted:	false
SSDEEP:	192:iDGaWqhWhWJWadJCsVWQ4mWd9afKUSIX01k9z3AEXzAU9:i6aWqhWACs92IR9z5EU9
MD5:	1C58526D681EFE507DEB8F1935C75487
SHA1:	0E6D328FAF3563F2AAE029BC5F2272FB7A742672
SHA-256:	EF13DCE8F71173315DFC64AB839B033AB19A968EE15230E9D4D2C9D558EFEEE2
SHA-512:	8EDB9A0022F417648E2ECE9E22C96E2727976332025C3E7D8F15BCF6D7D97E680D1BF008EB28E2E0BD57787DCBB71D38B2DEB995B8EDC35FA6852AB1D593F3D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....RS.........." .........0...............................................@......;.....`A........................................p...L............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	7.054510010549814
Encrypted:	false
SSDEEP:	384:eVrW1hWbvm0GftpBjzH4m3S9gTlUK3dsl:eVuAViaB/6sl
MD5:	BFFFA7117FD9B1622C66D949BAC3F1D7
SHA1:	402B7B8F8DCFD321B1D12FC85A1EE5137A5569B2
SHA-256:	1EA267A2E6284F17DD548C6F2285E19F7EDB15D6E737A55391140CE5CB95225E
SHA-512:	B319CC7B436B1BE165CDF6FFCAB8A87FE29DE78F7E0B14C8F562BE160481FB5483289BD5956FDC1D8660DA7A3F86D8EEDE35C6CC2B7C3D4C852DECF4B2DCDB7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...4.F>.........." .........................................................0............`.........................................`................ ...................=..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.625331165566263
Encrypted:	false
SSDEEP:	192:qzWqhWxWJWadJCsVWQ4mW8RJLNVAv+cQ0GX01k9z3ARo8ef3uBJu:qzWqhWwCsjNbZR9zQoEzu
MD5:	E89CDCD4D95CDA04E4ABBA8193A5B492
SHA1:	5C0AEE81F32D7F9EC9F0650239EE58880C9B0337
SHA-256:	1A489E0606484BD71A0D9CB37A1DC6CA8437777B3D67BFC8C0075D0CC59E6238
SHA-512:	55D01E68C8C899E99A3C62C2C36D6BCB1A66FF6ECD2636D2D0157409A1F53A84CE5D6F0C703D5ED47F8E9E2D1C9D2D87CC52585EE624A23D92183062C999B97E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....Hb..........." .........0...............................................@............`A........................................p...`............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.737397647066978
Encrypted:	false
SSDEEP:	192:OdxlZWqhWcWJWadJCsVWQ4mWlhtFyttuX01k9z3A2oD:OdxlZWqhWpCsctkSR9zfoD
MD5:	ACCC640D1B06FB8552FE02F823126FF5
SHA1:	82CCC763D62660BFA8B8A09E566120D469F6AB67
SHA-256:	332BA469AE84AA72EC8CCE2B33781DB1AB81A42ECE5863F7A3CB5A990059594F
SHA-512:	6382302FB7158FC9F2BE790811E5C459C5C441F8CAEE63DF1E09B203B8077A27E023C4C01957B252AC8AC288F8310BCEE5B4DCC1F7FC691458B90CDFAA36DCBE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....B.l.........." .........0...............................................@.......A....`A........................................p................0...............0..x&..............p............................................................................rdata..\|...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.6569647133331316
Encrypted:	false
SSDEEP:	192:dwWqhWWWEXCVWQ4mWLnySfKUSIX01k9z3AEXz5SLaDa3:iWqhWJhY2IR9z5YLt3
MD5:	C6024CC04201312F7688A021D25B056D
SHA1:	48A1D01AE8BC90F889FB5F09C0D2A0602EE4B0FD
SHA-256:	8751D30DF554AF08EF42D2FAA0A71ABCF8C7D17CE9E9FF2EA68A4662603EC500
SHA-512:	D86C773416B332945ACBB95CBE90E16730EF8E16B7F3CCD459D7131485760C2F07E95951AEB47C1CF29DE76AFFEB1C21BDF6D8260845E32205FE8411ED5EFA47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...}.o..........." .........0...............................................@......v.....`A........................................p................0...............0..h&..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.882042129450427
Encrypted:	false
SSDEEP:	192:9TvuBL3BBLAWqhWUWEXCVWQ4iWgdCLVx6RMySX01k9z3AzaXQ+BB:9TvuBL3BaWqhW/WSMR9zqaP
MD5:	1F2A00E72BC8FA2BD887BDB651ED6DE5
SHA1:	04D92E41CE002251CC09C297CF2B38C4263709EA
SHA-256:	9C8A08A7D40B6F697A21054770F1AFA9FFB197F90EF1EEE77C67751DF28B7142
SHA-512:	8CF72DF019F9FC9CD22FF77C37A563652BECEE0708FF5C6F1DA87317F41037909E64DCBDCC43E890C5777E6BCFA4035A27AFC1AEEB0F5DEBA878E3E9AEF7B02A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....g..........." .........0...............................................@............`A........................................p................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.355894399765837
Encrypted:	false
SSDEEP:	384:0naOMw3zdp3bwjGzue9/0jCRrndbnWqhW5lFydVXC4deR9zVj7xR:FOMwBprwjGzue9/0jCRrndbtGydVXC4O
MD5:	724223109E49CB01D61D63A8BE926B8F
SHA1:	072A4D01E01DBBAB7281D9BD3ADD76F9A3C8B23B
SHA-256:	4E975F618DF01A492AE433DFF0DD713774D47568E44C377CEEF9E5B34AAD1210
SHA-512:	19B0065B894DC66C30A602C9464F118E7F84D83010E74457D48E93AACA4422812B093B15247B24D5C398B42EF0319108700543D13F156067B169CCFB4D7B6B7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...0.&3.........." .........0...............................................@......L0....`A........................................p................0...............0..h&..............p............................................................................rdata..D...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.771309314175772
Encrypted:	false
SSDEEP:	192:L0WqhWTWEXCVWQ4cRWdmjKDUX01k9z3AQyMX/7kn:L0WqhWol1pR9zzDY
MD5:	3C38AAC78B7CE7F94F4916372800E242
SHA1:	C793186BCF8FDB55A1B74568102B4E073F6971D6
SHA-256:	3F81A149BA3862776AF307D5C7FEEF978F258196F0A1BF909DA2D3F440FF954D
SHA-512:	C2746AA4342C6AFFFBD174819440E1BBF4371A7FED29738801C75B49E2F4F94FD6D013E002BAD2AADAFBC477171B8332C8C5579D624684EF1AFBFDE9384B8588
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...`.@f.........." .........0...............................................@......K.....`A........................................p...l............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.7115212149950185
Encrypted:	false
SSDEEP:	192:bWqhWUxWJWadJCsVWQ4mW5iFyttuX01k9z3A2EC:bWqhWUwCs8SR9zfEC
MD5:	321A3CA50E80795018D55A19BF799197
SHA1:	DF2D3C95FB4CBB298D255D342F204121D9D7EF7F
SHA-256:	5476DB3A4FECF532F96D48F9802C966FDEF98EC8D89978A79540CB4DB352C15F
SHA-512:	3EC20E1AC39A98CB5F726D8390C2EE3CD4CD0BF118FDDA7271F7604A4946D78778713B675D19DD3E1EC1D6D4D097ABE9CD6D0F76B3A7DFF53CE8D6DBC146870A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...j............" .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.893761152454321
Encrypted:	false
SSDEEP:	192:dEFP2WqhWVWEXCVWQ4mW68vx6RMySX01k9z3AzapOP:eF+WqhWi6gMR9zqa0
MD5:	0462E22F779295446CD0B63E61142CA5
SHA1:	616A325CD5B0971821571B880907CE1B181126AE
SHA-256:	0B6B598EC28A9E3D646F2BB37E1A57A3DDA069A55FBA86333727719585B1886E
SHA-512:	07B34DCA6B3078F7D1E8EDE5C639F697C71210DCF9F05212FD16EB181AB4AC62286BC4A7CE0D84832C17F5916D0224D1E8AAB210CEEFF811FC6724C8845A74FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...L.Y..........." .........0...............................................@............`A........................................p...H............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	5.231196901820079
Encrypted:	false
SSDEEP:	192:/Mck1JzX9cKSI0WqhWsWJWadJCsVWQ4mWClLeyttuX01k9z3A2XCJq:Uck1JzNcKSI0WqhWZCsvfSR9zfyk
MD5:	C3632083B312C184CBDD96551FED5519
SHA1:	A93E8E0AF42A144009727D2DECB337F963A9312E
SHA-256:	BE8D78978D81555554786E08CE474F6AF1DE96FCB7FA2F1CE4052BC80C6B2125
SHA-512:	8807C2444A044A3C02EF98CF56013285F07C4A1F7014200A21E20FCB995178BA835C30AC3889311E66BC61641D6226B1FF96331B019C83B6FCC7C87870CCE8C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d....O.j.........." .........0...............................................@......9&....`A........................................p................0...............0..x&..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.799245167892134
Encrypted:	false
SSDEEP:	192:R0DfIeUWqhWLWJWadJCsVWQ4mWFVyttuX01k9z3A2YHmp:R0DfIeUWqhWiCsLSR9zfYHmp
MD5:	517EB9E2CB671AE49F99173D7F7CE43F
SHA1:	4CCF38FED56166DDBF0B7EFB4F5314C1F7D3B7AB
SHA-256:	57CC66BF0909C430364D35D92B64EB8B6A15DC201765403725FE323F39E8AC54
SHA-512:	492BE2445B10F6BFE6C561C1FC6F5D1AF6D1365B7449BC57A8F073B44AE49C88E66841F5C258B041547FCD33CBDCB4EB9DD3E24F0924DB32720E51651E9286BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....#..........." .........0...............................................@.......,....`A........................................p................0...............0..x&..............p............................................................................rdata..\...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.587063911311469
Encrypted:	false
SSDEEP:	192:fWqhWeWJWadJCsVWQ4mWMs7DENNVAv+cQ0GX01k9z3ARoIGA/:fWqhWbCs8oNbZR9zQoxS
MD5:	F3FF2D544F5CD9E66BFB8D170B661673
SHA1:	9E18107CFCD89F1BBB7FDAF65234C1DC8E614ADD
SHA-256:	E1C5D8984A674925FA4AFBFE58228BE5323FE5123ABCD17EC4160295875A625F
SHA-512:	184B09C77D079127580EF80EB34BDED0F5E874CEFBE1C5F851D86861E38967B995D859E8491FCC87508930DC06C6BBF02B649B3B489A1B138C51A7D4B4E7AAAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......e.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..P...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.754374422741657
Encrypted:	false
SSDEEP:	192:CGeVPWqhWUWJWadJCsVWQ4mWUhSqyttuX01k9z3A2lqn7cq:CGeVPWqhWBCsvoSR9zflBq
MD5:	A0C2DBE0F5E18D1ADD0D1BA22580893B
SHA1:	29624DF37151905467A223486500ED75617A1DFD
SHA-256:	3C29730DF2B28985A30D9C82092A1FAA0CEB7FFC1BD857D1EF6324CF5524802F
SHA-512:	3E627F111196009380D1687E024E6FFB1C0DCF4DCB27F8940F17FEC7EFDD8152FF365B43CB7FDB31DE300955D6C15E40A2C8FB6650A91706D7EA1C5D89319B12
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d......Z.........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.664553499673792
Encrypted:	false
SSDEEP:	192:mZyMvr5WqhWAWJWadJCsVWQ4mWWqpNVAv+cQ0GX01k9z3ARo+GZ:mZyMvlWqhWNCsUpNbZR9zQo+GZ
MD5:	2666581584BA60D48716420A6080ABDA
SHA1:	C103F0EA32EBBC50F4C494BCE7595F2B721CB5AD
SHA-256:	27E9D3E7C8756E4512932D674A738BF4C2969F834D65B2B79C342A22F662F328
SHA-512:	BEFED15F11A0550D2859094CC15526B791DADEA12C2E7CEB35916983FB7A100D89D638FB1704975464302FAE1E1A37F36E01E4BEF5BC4924AB8F3FD41E60BD0C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....I..........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..l...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	5.146069394118203
Encrypted:	false
SSDEEP:	384:vUwidv3V0dfpkXc0vVaCsWqhWjCsa2IR9z5Bk5l:sHdv3VqpkXc0vVaP+U9zzk5l
MD5:	225D9F80F669CE452CA35E47AF94893F
SHA1:	37BD0FFC8E820247BD4DB1C36C3B9F9F686BBD50
SHA-256:	61C0EBE60CE6EBABCB927DDFF837A9BF17E14CD4B4C762AB709E630576EC7232
SHA-512:	2F71A3471A9868F4D026C01E4258AFF7192872590F5E5C66AABD3C088644D28629BA8835F3A4A23825631004B1AFD440EFE7161BB9FC7D7C69E0EE204813CA7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....x.........." .........0...............................................@.......J....`A........................................p...X............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.834520503429805
Encrypted:	false
SSDEEP:	192:etZ3xWqhWqWJWadJCsVWQ4mWfH/fKUSIX01k9z3AEXz40OY:etZ3xWqhWHCsMH2IR9z5OY
MD5:	1281E9D1750431D2FE3B480A8175D45C
SHA1:	BC982D1C750B88DCB4410739E057A86FF02D07EF
SHA-256:	433BD8DDC4F79AEE65CA94A54286D75E7D92B019853A883E51C2B938D2469BAA
SHA-512:	A954E6CE76F1375A8BEAC51D751B575BBC0B0B8BA6AA793402B26404E45718165199C2C00CCBCBA3783C16BDD96F0B2C17ADDCC619C39C8031BECEBEF428CE77
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................." .........0...............................................@.......w....`A........................................p...x............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.916367637528538
Encrypted:	false
SSDEEP:	192:qaIMFSYWqhWzWJWadJCsVWQ4mW14LyttuX01k9z3A2ClV:qdYWqhWqCsISR9zfCT
MD5:	FD46C3F6361E79B8616F56B22D935A53
SHA1:	107F488AD966633579D8EC5EB1919541F07532CE
SHA-256:	0DC92E8830BC84337DCAE19EF03A84EF5279CF7D4FDC2442C1BC25320369F9DF
SHA-512:	3360B2E2A25D545CCD969F305C4668C6CDA443BBDBD8A8356FFE9FBC2F70D90CF4540F2F28C9ED3EEA6C9074F94E69746E7705E6254827E6A4F158A75D81065B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...~.l-.........." .........0...............................................@............`A........................................p................0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.829681745003914
Encrypted:	false
SSDEEP:	192:HNpWqhW5WJWadJCsVWQ4mWbZyttuX01k9z3A2qkFU:HXWqhW4Cs1SR9zf9U
MD5:	D12403EE11359259BA2B0706E5E5111C
SHA1:	03CC7827A30FD1DEE38665C0CC993B4B533AC138
SHA-256:	F60E1751A6AC41F08E46480BF8E6521B41E2E427803996B32BDC5E78E9560781
SHA-512:	9004F4E59835AF57F02E8D9625814DB56F0E4A98467041DA6F1367EF32366AD96E0338D48FFF7CC65839A24148E2D9989883BCDDC329D9F4D27CAE3F843117D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...>.os.........." .........0...............................................@............`A........................................p...H............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.612408827336625
Encrypted:	false
SSDEEP:	192:CWqhW+WJWadJCsVWQ4mWprgfKUSIX01k9z3AEXzh:CWqhW7Cs12IR9z5F
MD5:	0F129611A4F1E7752F3671C9AA6EA736
SHA1:	40C07A94045B17DAE8A02C1D2B49301FAD231152
SHA-256:	2E1F090ABA941B9D2D503E4CD735C958DF7BB68F1E9BDC3F47692E1571AAAC2F
SHA-512:	6ABC0F4878BB302713755A188F662C6FE162EA6267E5E1C497C9BA9FDDBDAEA4DB050E322CB1C77D6638ECF1DAD940B9EBC92C43ACAA594040EE58D313CBCFAE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....+..........." .........0...............................................@............`A........................................p...<............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.918215004381039
Encrypted:	false
SSDEEP:	192:OvMWqhWkWJWadJCsVWQ4mWoz/HyttuX01k9z3A21O:JWqhWxCs/SSR9zf1O
MD5:	D4FBA5A92D68916EC17104E09D1D9D12
SHA1:	247DBC625B72FFB0BF546B17FB4DE10CAD38D495
SHA-256:	93619259328A264287AEE7C5B88F7F0EE32425D7323CE5DC5A2EF4FE3BED90D5
SHA-512:	D5A535F881C09F37E0ADF3B58D41E123F527D081A1EBECD9A927664582AE268341771728DC967C30908E502B49F6F853EEAEBB56580B947A629EDC6BCE2340D8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...Aj............" .........0...............................................@......UJ....`A.........................................................0...............0..x&..............p............................................................................rdata..p...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26216
Entropy (8bit):	4.882777558752248
Encrypted:	false
SSDEEP:	192:I9cy5WqhWKWEXCVWQ4mW1pbm6yttuX01k9z3A2jyM:Ry5WqhWdcbmLSR9zfjj
MD5:	EDF71C5C232F5F6EF3849450F2100B54
SHA1:	ED46DA7D59811B566DD438FA1D09C20F5DC493CE
SHA-256:	B987AB40CDD950EBE7A9A9176B80B8FFFC005CCD370BB1CBBCAD078C1A506BDC
SHA-512:	481A3C8DC5BEF793EE78CE85EC0F193E3E9F6CD57868B813965B312BD0FADEB5F4419707CD3004FBDB407652101D52E061EF84317E8BD458979443E9F8E4079A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...U.gJ.........." .........@...............................................P............`A.........................................................@...............@..h&..............p............................................................................rdata..n........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.738587310329139
Encrypted:	false
SSDEEP:	192:TWqhWXWEXCVWQ4mWPXTNyttuX01k9z3A2dGxr:TWqhWMKASR9zfYxr
MD5:	F9235935DD3BA2AA66D3AA3412ACCFBF
SHA1:	281E548B526411BCB3813EB98462F48FFAF4B3EB
SHA-256:	2F6BD6C235E044755D5707BD560A6AFC0BA712437530F76D11079D67C0CF3200
SHA-512:	AD0C0A7891FB8328F6F0CF1DDC97523A317D727C15D15498AFA53C07610210D2610DB4BC9BD25958D47ADC1AF829AD4D7CF8AABCAB3625C783177CCDB7714246
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...9.4o.........." .........0...............................................@......h*....`A............................................"............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.202163846121633
Encrypted:	false
SSDEEP:	192:2pUEpnWlC0i5CBWqhWXLeWEXCVWQ4iW+/x6RMySX01k9z3Aza8Az629:2ptnWm5CBWqhWtWMR9zqaH629
MD5:	5107487B726BDCC7B9F7E4C2FF7F907C
SHA1:	EBC46221D3C81A409FAB9815C4215AD5DA62449C
SHA-256:	94A86E28E829276974E01F8A15787FDE6ED699C8B9DC26F16A51765C86C3EADE
SHA-512:	A0009B80AD6A928580F2B476C1BDF4352B0611BB3A180418F2A42CFA7A03B9F0575ED75EC855D30B26E0CCA96A6DA8AFFB54862B6B9AFF33710D2F3129283FAA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......M4....`A.........................................................0...............0..h&..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.866983142029453
Encrypted:	false
SSDEEP:	192:0vh8Y17aFBRsWqhW9AWEXCVWQ4mWCB4Lrp0KBQfX01k9z3ALkg5Z7:SL5WqhW9boRxB+R9z2kM7
MD5:	D5D77669BD8D382EC474BE0608AFD03F
SHA1:	1558F5A0F5FACC79D3957FF1E72A608766E11A64
SHA-256:	8DD9218998B4C4C9E8D8B0F8B9611D49419B3C80DAA2F437CBF15BCFD4C0B3B8
SHA-512:	8DEFA71772105FD9128A669F6FF19B6FE47745A0305BEB9A8CADB672ED087077F7538CD56E39329F7DAA37797A96469EAE7CD5E4CCA57C9A183B35BDC44182F3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...."]..........." .........0...............................................@............`A.........................................................0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.828044267819929
Encrypted:	false
SSDEEP:	192:dUnWqhWRWJWadJCsVWQ4mW+2PyttuX01k9z3A23y:cWqhWQCsHSR9zf3y
MD5:	650435E39D38160ABC3973514D6C6640
SHA1:	9A5591C29E4D91EAA0F12AD603AF05BB49708A2D
SHA-256:	551A34C400522957063A2D71FA5ABA1CD78CC4F61F0ACE1CD42CC72118C500C0
SHA-512:	7B4A8F86D583562956593D27B7ECB695CB24AB7192A94361F994FADBA7A488375217755E7ED5071DE1D0960F60F255AA305E9DD477C38B7BB70AC545082C9D5E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...6..q.........." .........0...............................................@.......-....`A............................................e............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30328
Entropy (8bit):	5.14173409150951
Encrypted:	false
SSDEEP:	384:r7yaFM4Oe59Ckb1hgmLVWqhW2CsWNbZR9zQoekS:/FMq59Bb1jnoFT9zGp
MD5:	B8F0210C47847FC6EC9FBE2A1AD4DEBB
SHA1:	E99D833AE730BE1FEDC826BF1569C26F30DA0D17
SHA-256:	1C4A70A73096B64B536BE8132ED402BCFB182C01B8A451BFF452EFE36DDF76E7
SHA-512:	992D790E18AC7AE33958F53D458D15BFF522A3C11A6BD7EE2F784AC16399DE8B9F0A7EE896D9F2C96D1E2C8829B2F35FF11FC5D8D1B14C77E22D859A1387797C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d................" .........P...............................................`............`A.............................................%...........P...............P..x&..............p............................................................................rdata...'.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	4.883012715268179
Encrypted:	false
SSDEEP:	192:5eXrqjd7ZWqhW3WEXCVWQ4mW3Ql1Lrp0KBQfX01k9z3ALkjY/12:54rgWqhWsP1RxB+R9z2kjY/Y
MD5:	272C0F80FD132E434CDCDD4E184BB1D8
SHA1:	5BC8B7260E690B4D4039FE27B48B2CECEC39652F
SHA-256:	BD943767F3E0568E19FB52522217C22B6627B66A3B71CD38DD6653B50662F39D
SHA-512:	94892A934A92EF1630FBFEA956D1FE3A3BFE687DEC31092828960968CB321C4AB3AF3CAF191D4E28C8CA6B8927FBC1EC5D17D5C8A962C848F4373602EC982CD4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...<SdT.........." .........0...............................................@......N.....`A............................................x............0...............0..h&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26208
Entropy (8bit):	5.023753175006074
Encrypted:	false
SSDEEP:	192:4mGqX8mPrpJhhf4AN5/KiFWqhWyzWEXCVWQ4OW4034hHssDX01k9z3AaYX2cWo:4ysyr77WqhWyI0oFDR9z9YH9
MD5:	20C0AFA78836B3F0B692C22F12BDA70A
SHA1:	60BB74615A71BD6B489C500E6E69722F357D283E
SHA-256:	962D725D089F140482EE9A8FF57F440A513387DD03FDC06B3A28562C8090C0BC
SHA-512:	65F0E60136AB358661E5156B8ECD135182C8AAEFD3EC320ABDF9CFC8AEAB7B68581890E0BBC56BAD858B83D47B7A0143FA791195101DC3E2D78956F591641D16
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.....TR.........." .........@...............................................P......D!....`A............................................4............@...............@..`&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26232
Entropy (8bit):	5.289041983400337
Encrypted:	false
SSDEEP:	192:UuV2OlkuWYFxEpahfWqhWNWJWadJCsVWQ4mWeX9UfKUSIX01k9z3AEXzGd5S:dV2oFVhfWqhWMCstE2IR9z5Sd5S
MD5:	96498DC4C2C879055A7AFF2A1CC2451E
SHA1:	FECBC0F854B1ADF49EF07BEACAD3CEC9358B4FB2
SHA-256:	273817A137EE049CBD8E51DC0BB1C7987DF7E3BF4968940EE35376F87EF2EF8D
SHA-512:	4E0B2EF0EFE81A8289A447EB48898992692FEEE4739CEB9D87F5598E449E0059B4E6F4EB19794B9DCDCE78C05C8871264797C14E4754FD73280F37EC3EA3C304
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...k. U.........." .........@...............................................P............`A............................................a............@...............@..x&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26232
Entropy (8bit):	5.284932479906984
Encrypted:	false
SSDEEP:	384:tCLx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWqhWbQCsMSR9zful:tCV5yguNvZ5VQgx3SbwA71IkFGqHe9zI
MD5:	115E8275EB570B02E72C0C8A156970B3
SHA1:	C305868A014D8D7BBEF9ABBB1C49A70E8511D5A6
SHA-256:	415025DCE5A086DBFFC4CF322E8EAD55CB45F6D946801F6F5193DF044DB2F004
SHA-512:	B97EF7C5203A0105386E4949445350D8FF1C83BDEAEE71CCF8DC22F7F6D4F113CB0A9BE136717895C36EE8455778549F629BF8D8364109185C0BF28F3CB2B2CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d.... .h.........." .........@...............................................P......\.....`A.........................................................@...............@..x&..............p............................................................................rdata.._........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22120
Entropy (8bit):	5.253102285412285
Encrypted:	false
SSDEEP:	192:mt3hwDGWqhWrWEXCVWQ4mWn+deyttuX01k9z3A23x:AWqhWgPSR9zfh
MD5:	001E60F6BBF255A60A5EA542E6339706
SHA1:	F9172EC37921432D5031758D0C644FE78CDB25FA
SHA-256:	82FBA9BC21F77309A649EDC8E6FC1900F37E3FFCB45CD61E65E23840C505B945
SHA-512:	B1A6DC5A34968FBDC8147D8403ADF8B800A06771CC9F15613F5CE874C29259A156BAB875AAE4CAAEC2117817CE79682A268AA6E037546AECA664CD4EEA60ADBF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...G............" .........0...............................................@.......&....`A.........................................................0...............0..h&..............p............................................................................rdata..=...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	4.810971823417463
Encrypted:	false
SSDEEP:	192:p/fHQduDWqhWJWJWadJCsVWQ4mWxrnyttuX01k9z3A2Yv6WT:p/ftWqhWoCsmySR9zfYvvT
MD5:	A0776B3A28F7246B4A24FF1B2867BDBF
SHA1:	383C9A6AFDA7C1E855E25055AAD00E92F9D6AAFF
SHA-256:	2E554D9BF872A64D2CD0F0EB9D5A06DEA78548BC0C7A6F76E0A0C8C069F3C0A9
SHA-512:	7C9F0F8E53B363EF5B2E56EEC95E7B78EC50E9308F34974A287784A1C69C9106F49EA2D9CA037F0A7B3C57620FCBB1C7C372F207C68167DF85797AFFC3D7F3BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........v...v...v..~...v..v...v..r...v.....v..t...v.Rich..v.................PE..d...2............." .........0...............................................@......^.....`A............................................^............0...............0..x&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\base_library.zip

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332769
Entropy (8bit):	5.586500387964223
Encrypted:	false
SSDEEP:	12288:VHlJGUqQbLGgBvc+fYNXPh26UZWAzyX7jsYQqPQOxi25dmyPHHzVdXR1RbtRwB/:VHlJGUd6+zy/sUVZ5dmyPnTBHtRwB/
MD5:	ABA776964E87291A556A2D5389476D1E
SHA1:	41C45C987BB01D44901A9C6C41817196FE2AA799
SHA-256:	A9790E38C2E50F57E9B892AE16EBF726AF09B185342B76BA57EB600B2D8994D6
SHA-512:	4DD38B435437472F3B8EF52AA145894AAE33C9541E6EEACE846DEBC64863D9831841B39C5FF9B9683E66979E229B29751A8509BA423ECA79DB06CFF54DBF9363
Malicious:	false
Preview:	PK..........!./gJ.O...O......._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI13962\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290282
Entropy (8bit):	6.048183244201235
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5Np:QWN/TRJLWURrI55MWavdF0L
MD5:	302B49C5F476C0AE35571430BB2E4AA0
SHA1:	35A7837A3F1B960807BF46B1C95EC22792262846
SHA-256:	CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748
SHA-512:	1345AF52984B570B1FF223032575FEB36CDFB4F38E75E0BD3B998BC46E9C646F7AC5C583D23A70460219299B9C04875EF672BF5A0D614618731DF9B7A5637D0A
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI13962\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.674392865869017
Encrypted:	false
SSDEEP:	96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5:	D9E0217A89D9B9D1D778F7E197E0C191
SHA1:	EC692661FCC0B89E0C3BDE1773A6168D285B4F0D
SHA-256:	ECF12E2C0A00C0ED4E2343EA956D78EED55E5A36BA49773633B2DFE7B04335C0
SHA-512:	3B788AC88C1F2D682C1721C61D223A529697C7E43280686B914467B3B39E7D6DEBAFF4C0E2F42E9DDDB28B522F37CB5A3011E91C66D911609C63509F9228133D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d....jAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.917175475547778
Encrypted:	false
SSDEEP:	3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5:	BF9A9DA1CF3C98346002648C3EAE6DCF
SHA1:	DB16C09FDC1722631A7A9C465BFE173D94EB5D8B
SHA-256:	4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637
SHA-512:	7371407D12E632FC8FB031393838D36E6A1FE1E978CED36FF750D84E183CDE6DD20F75074F4597742C9F8D6F87AF12794C589D596A81B920C6C62EE2BA2E5654
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d....jAe.........." ...%.:...........<.......................................0............`.........................................@...d.......................(............ ......P...................................@............P...............................text....8.......:.................. ..`.rdata...W...P...X...>..............@..@.data...8=.......0..................@....pdata..(...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5292
Entropy (8bit):	5.115440205505611
Encrypted:	false
SSDEEP:	96:DxapqZink/QIHQIyzQIZQILuQIR8vtklGovxNx6sWwCvCCcTKvIrrg9BMM6VwDjz:sJnkoBs/sqLz8cTKvIrrUiM6VwDjyeWs
MD5:	137D13F917D94C83137A0FA5AE12B467
SHA1:	01E93402C225BF2A4EE59F9A06F8062CB5E4801E
SHA-256:	36738E6971D2F20DB78433185A0EF7912A48544AA6FF7006505A7DC785158859
SHA-512:	1B22CBC6E22FA5E2BD5CC4A370443A342D00E7DD53330A4000E9A680DE80262BCA7188764E3568944D01025188291602AC8C53C971630984FBD9FA7D75AAB124
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 41.0.7..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15334
Entropy (8bit):	5.552806309785179
Encrypted:	false
SSDEEP:	384:3X62U/ZfaigdSwJN5i6s7B0Ppzx6uvndLE4:3NUxfzgFthE4
MD5:	D88787EC6163B4F45579EA7CF7F56044
SHA1:	B241754AF16F5B2523DE1D07520DADB5ABA559BA
SHA-256:	E5265DE4206BAB1FB0C96212067AA1EB479C85AB0495B915938DDB365B0C948D
SHA-512:	F4F1C213458AC42A3417A870F7C6D2A125950F588C76F8A83D605242ABBDBCC2CBE70CA49A700710AA23AC143F2702963DEA48043C5CA86FBF0D3CE07126C696
Malicious:	false
Preview:	cryptography-41.0.7.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-41.0.7.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-41.0.7.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-41.0.7.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-41.0.7.dist-info/METADATA,sha256=NnOOaXHS8g23hDMYWg73kSpIVEqm_3AGUFp9x4UViFk,5292..cryptography-41.0.7.dist-info/RECORD,,..cryptography-41.0.7.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-41.0.7.dist-info/WHEEL,sha256=-EX5DQzNGQEoyL99Q-0P0-D-CXbfqafenaAeiSQ_Ufk,100..cryptography-41.0.7.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=uPXMbbcptt7EzZ_jllGRx0pVdMn-NBsAM4L74hOv-b0,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/_

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.0203365408149025
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tkKc/SKQLn:RtBMwlVCxWKxDQLn
MD5:	4B432A99682DE414B29A683A3546B69F
SHA1:	F59C5016889EE5E9F62D09B22AEFBC2211A56C93
SHA-256:	F845F90D0CCD190128C8BF7D43ED0FD3E0FE0976DFA9A7DE9DA01E89243F51F9
SHA-512:	CBBF10E19B6F4072C416EA95D7AE259B9C5A1B89068B7B6660B7C637D6F2437AEA8D8202A2E26A0BEC36DAECD8BBB6B59016FC2DDEB13C545F0868B3E15479CA
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp37-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography-41.0.7.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:	3:cOv:Nv
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI13962\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6673920
Entropy (8bit):	6.582002531606852
Encrypted:	false
SSDEEP:	98304:EzN+T+xtLlk0PPMAiGoTzeDy3x8lGBlWi9Nk:E5Y6Jk0PPMtfTzp3x8c
MD5:	486085AAC7BB246A173CEEA0879230AF
SHA1:	EF1095843B2A9C6D8285C7D9E8E334A9CE812FAE
SHA-256:	C3964FC08E4CA8BC193F131DEF6CC4B4724B18073AA0E12FED8B87C2E627DC83
SHA-512:	8A56774A08DA0AB9DD561D21FEBEEBC23A5DEA6F63D5638EA1B608CD923B857DF1F096262865E6EBD56B13EFD3BBA8D714FFDCE8316293229974532C49136460
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......QN.../.../.../...W(../......./......./......./......./...R.../...Z.../..^W.../.../...-../...",......./.../.../......./......./..Rich./..........PE..d...M7ee.........." ...&..M..........L...................................... f...........`......................................... .a.p.....a.\|............Pb..............Pe.p...p.[.T.....................[.(...0.[.@............0M..............................text.....M.......M................. ..`.rdata.......0M.......M.............@..@.data........0a.......a.............@....pdata.......Pb.......b.............@..@.reloc..p....Pe.......e.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5191960
Entropy (8bit):	5.962142634441191
Encrypted:	false
SSDEEP:	98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5:	E547CF6D296A88F5B1C352C116DF7C0C
SHA1:	CAFA14E0367F7C13AD140FD556F10F320A039783
SHA-256:	05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
SHA-512:	9F42EDF04C7AF350A00FA4FDF92B8E2E6F47AB9D2D41491985B20CD0ADDE4F694253399F6A88F4BDD765C4F49792F25FB01E84EC03FD5D0BE8BB61773D77D74D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%..7..4......v.........................................O.......P...`.........................................P.H.0....kN.@.....N.\|.....K.d.....O../....N....P.C.8.............................C.@............`N..............................text.....7.......7................. ..`.rdata....... 7.......7.............@..@.data....n....K..<....J.............@....pdata..0.....K......4K.............@..@.idata...%...`N..&....N.............@..@.00cfg..u.....N.......N.............@..@.rsrc...\|.....N......0N.............@..@.reloc........N......8N.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	787224
Entropy (8bit):	5.609561366841894
Encrypted:	false
SSDEEP:	12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
MD5:	19A2ABA25456181D5FB572D88AC0E73E
SHA1:	656CA8CDFC9C3A6379536E2027E93408851483DB
SHA-256:	2E9FBCD8F7FDC13A5179533239811456554F2B3AA2FB10E1B17BE0DF81C79006
SHA-512:	DF17DC8A882363A6C5A1B78BA3CF448437D1118CCC4A6275CC7681551B13C1A4E0F94E30FFB94C3530B688B62BFF1C03E57C2C185A7DF2BF3E5737A06E114337
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%...........K........................................ ............`..........................................g...Q..............s.......@M......./......`.......8...........................`...@............p...............................text...D)......................... ..`.rdata..Hy...@...z..................@..@.data....N.......H..................@....pdata...V.......X..................@..@.idata...c...p...d...H..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..4...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	202008
Entropy (8bit):	6.367263484296302
Encrypted:	false
SSDEEP:	6144:4nwukKYdeMwj1XQk67ZLXni8Es7sp0HhiviBvDKax:KrqiviMax
MD5:	815F1BDABB79C6A12B38D84AA343196D
SHA1:	916483149875A5E20C6046CEFFEF62DD6089DDD5
SHA-256:	31712AE276E2CED05ECDA3E1C08FBBCC2CFF8474A972626ABA55F7797F0ED8C9
SHA-512:	1078E7E48B6F6ED160AE2BCCF80A43A5F1CCA769B8A690326E112BF20D7F3D018F855F6AA3B56D315DC0853472E0AFFCFE8E910B5CE69CE952983CFAA496C21D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!...@..@..@..8N..@.:...@.:...@.:...@.:...@.....@..8..@..@..@.....@.....@..."..@.....@.Rich.@.........PE..d.....f.........." ...(..................................................... ......?.....`............................................P...@............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...p ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\python3.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.148788033723542
Encrypted:	false
SSDEEP:	768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/D:BDmF61JFn+/O/BI1L057Sy+xF
MD5:	8DBE9BBF7118F4862E02CD2AAF43F1AB
SHA1:	935BC8C5CEA4502D0FACF0C49C5F2B9C138608ED
SHA-256:	29F173E0147390A99F541BA0C0231FDD7DFBCA84D0E2E561EF352BF1EC72F5DB
SHA-512:	938F8387DCC356012AC4A952D371664700B110F7111FCC24F5DF7D79791AE95BAD0DBAF77D2D6C86C820BFD48A6BDBE8858B7E7AE1A77DF88E596556C7135ED4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5...Te..Te..Te...m..Te...e..Te.....Te...g..Te.Rich.Te.................PE..d......f.........." ...(..................................................................`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\python312.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6927640
Entropy (8bit):	5.765554952149868
Encrypted:	false
SSDEEP:	49152:Jc7/HNCHh0IWiUDFsx3hghs7g6kIPuch+Xe16/02yWYqiVx7qb4f4wmC36nhIVcF:JcBZhxsje2kUvid5E+vbHDMiEr/l9o
MD5:	CAE8FA4E7CB32DA83ACF655C2C39D9E1
SHA1:	7A0055588A2D232BE8C56791642CB0F5ABBC71F8
SHA-256:	8AD53C67C2B4DB4387D5F72EE2A3CA80C40AF444B22BF41A6CFDA2225A27BB93
SHA-512:	DB2190DA2C35BCEED0EF91D7553FF0DEA442286490145C3D0E89DB59BA1299B0851E601CC324B5F7FD026414FC73755E8EFF2EF5FB5EEB1C54A9E13E7C66DD0C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..Z%..Z%..Z%......X%....e.T%......^%......R%......W%..S]..@%...]..Q%..Z%..$..O....%..O...[%..O.g.[%..O...[%..RichZ%..........PE..d......f.........." ...(..(..6B...............................................j......dj...`.........................................pdN.d....1O.......i......._.`I....i../... i..[..0.2.T.....................H.(....2.@............ (..............................text.....(.......(................. ..`.rdata..f7'.. (..8'...(.............@..@.data....J...`O......HO.............@....pdata..`I...._..J....^.............@..@PyRuntim0.....b.......a.............@....rsrc.........i...... h.............@..@.reloc...[... i..\...h.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\select.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.553885009751671
Encrypted:	false
SSDEEP:	384:I8RVBC9t6Lhz64SHfZslDT90YBI1QGjHQIYiSy1pCQQRaAM+o/8E9VF0NytuSS:1GyqHfK1HBI1QGT5YiSyvXAMxkEm
MD5:	79CE1AE3A23DFF6ED5FC66E6416600CD
SHA1:	6204374D99144B0A26FD1D61940FF4F0D17C2212
SHA-256:	678E09AD44BE42FA9BC9C7A18C25DBE995A59B6C36A13EECC09C0F02A647B6F0
SHA-512:	A4E48696788798A7D061C0EF620D40187850741C2BEC357DB0E37A2DD94D3A50F9F55BA75DC4D95E50946CBAB78B84BA1FC42D51FD498640A231321566613DAA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'-..&..'-..&..'-..&..'-..&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'................PE..d.....f.........." ...(.....2......................................................._....`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\autocommand-2.2.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\autocommand-2.2.2.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7634
Entropy (8bit):	4.503638339817033
Encrypted:	false
SSDEEP:	192:qnJvhVL0qhYqlpIle4RrJQSqOBng4kS/cKM6b:4vjxhYWpce48engvK
MD5:	8466CFC6533376D42EFA6F7423F2B8E8
SHA1:	2BC8926FDBB07DB2AF0A8E3FF7A3BE545C8BDF6B
SHA-256:	ADE78D04982D69972D444A8E14A94F87A2334DD3855CC80348EA8E240AA0DF2D
SHA-512:	CC45DC470E107E63659B502F77E9EF44335F9427BE87639252D85181A8DEA65FA9D1B5F1BD196F782186BC61B144467888199537806A8CC15E2B462CAC0D46A5
Malicious:	false
Preview:	GNU LESSER GENERAL PUBLIC LICENSE. Version 3, 29 June 2007.. Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed.... This version of the GNU Lesser General Public License incorporates.the terms and conditions of version 3 of the GNU General Public.License, supplemented by the additional permissions listed below... 0. Additional Definitions... As used herein, "this License" refers to version 3 of the GNU Lesser.General Public License, and the "GNU GPL" refers to version 3 of the GNU.General Public License... "The Library" refers to a covered work governed by this License,.other than an Application or a Combined Work as defined below... An "Application" is any work that makes use of an interface provided.by the Library, but which is not otherwise based on the Library..Defining a subclass of a class defined by the Library is de

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\autocommand-2.2.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Python script, ASCII text executable, with very long lines (855)
Category:	dropped
Size (bytes):	15006
Entropy (8bit):	4.800156894367144
Encrypted:	false
SSDEEP:	192:S037UxjwUbQd1Ak++k59jg8dXRNInXF2IOxcme+kQBd9Clb:d37U1LbQd1Z+3e8dhwXFacb+kQjQb
MD5:	542BA4FBC993C39A0BC952BE72E8717F
SHA1:	4310DB58F98C12B23286E5FA37F0E27ABEFB6A4A
SHA-256:	3800D9B91DCEEA2065A6ED6279383362E97AC38B8E56B9343F404EE531860099
SHA-512:	E3672EA056E5F2EFD3685C98DC0CF47E9A44F5A84DC457FC8AB31CD6DE09559C6E566D2D00F5B3CE55511E81A050DBB0DED6CF941916A6FF1019392FD96E1636
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: autocommand.Version: 2.2.2.Summary: A library to create a command-line program from a function.Home-page: https://github.com/Lucretiel/autocommand.Author: Nathan West.License: LGPLv3.Project-URL: Homepage, https://github.com/Lucretiel/autocommand.Project-URL: Bug Tracker, https://github.com/Lucretiel/autocommand/issues.Platform: any.Classifier: Development Status :: 6 - Mature.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3).Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development.Classifier: Topic :: Software Development :: Libraries.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Requires-Python: >=3.7.Description-Content-Type: text/markdown.License-File: LICENSE..[![PyPI version](https://badge.fury.io/py/autocommand.svg)](

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\autocommand-2.2.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.721750099226425
Encrypted:	false
SSDEEP:	24:kn/2zDcMvX4owkE+RlpGUttyvUMDtuH5p4D127cyOMT34:knuXNv4LkEMl0UWMF5p45AcuT34
MD5:	52BF4937018B88B9D28ED98A76B5E2AC
SHA1:	C8D5B732C154A2D4D501454647FAFEB356B93C4E
SHA-256:	822BBA66B41526FA547186B80221F85DA50D652BEE5493DBFE5D14085112F0C3
SHA-512:	30E4DEFE09FB8907166682F9A33E0F7CC0203B65113155BBEC6548A1EADF7250882AF295FF2551803703274F9F387E00439D95CBBCB63D2E04E371B94556B3EE
Malicious:	false
Preview:	autocommand-2.2.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..autocommand-2.2.2.dist-info/LICENSE,sha256=reeNBJgtaZctREqOFKlPh6IzTdOFXMgDSOqOJAqg3y0,7634..autocommand-2.2.2.dist-info/METADATA,sha256=OADZuR3O6iBlpu1ieTgzYul6w4uOVrk0P0BO5TGGAJk,15006..autocommand-2.2.2.dist-info/RECORD,,..autocommand-2.2.2.dist-info/WHEEL,sha256=2wepM1nk4DS4eFpYrW1TTqPcoGNfHhhO_i5m4cOimbo,92..autocommand-2.2.2.dist-info/top_level.txt,sha256=AzfhgKKS8EdAwWUTSF8mgeVQbXOY9kokHB6kSqwwqu0,12..autocommand/__init__.py,sha256=zko5Rnvolvb-UXjCx_2ArPTGBWwUK5QY4LIQIKYR7As,1037..autocommand/__pycache__/__init__.cpython-312.pyc,,..autocommand/__pycache__/autoasync.cpython-312.pyc,,..autocommand/__pycache__/autocommand.cpython-312.pyc,,..autocommand/__pycache__/automain.cpython-312.pyc,,..autocommand/__pycache__/autoparse.cpython-312.pyc,,..autocommand/__pycache__/errors.cpython-312.pyc,,..autocommand/autoasync.py,sha256=AMdyrxNS4pqWJfP_xuoOcImOHWD-qT7x06wmKN1Vp-U,5680..autocommand/autoco

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\autocommand-2.2.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViJR4KgP+tPCCfA5S:RtBMwlVifAWBBf
MD5:	88F09A0EC874FD86ABCB9BC4E265B874
SHA1:	786AB44FFD2F5C632B4DC5C1BF4AA2E91E579A05
SHA-256:	DB07A93359E4E034B8785A58AD6D534EA3DCA0635F1E184EFE2E66E1C3A299BA
SHA-512:	7FFEF1EC782D590D2879294C2895A5A8064ECD5FE7243CF602FCCE66A8A715F64436F17CE96070B613123847EE0C18AB0AA5BC87DB13E98A792DC07DD95E4BAB
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.38.4).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\autocommand-2.2.2.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.084962500721156
Encrypted:	false
SSDEEP:	3:5EEln:aM
MD5:	C3FBD7931840D987F261BEBA8C77C4D2
SHA1:	F7EE740BCB5C39966173CC377817A157D55844F7
SHA-256:	0337E180A292F04740C16513485F2681E5506D7398F64A241C1EA44AAC30AAED
SHA-512:	E1FA2DE0EE416AE68C57A0173C82D42A8F24DDD1E5143A1B76A3743B5EC3DDF11FB3950F27469D3D8FCAC4958CE267A7321D2F888671EDD7C2E95D0F3F8F7455
Malicious:	false
Preview:	autocommand.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2020
Entropy (8bit):	5.0469065437932175
Encrypted:	false
SSDEEP:	48:DfdqaaC3P1xe9okGw1w8wQwywbM0kvsJib0ts++kv0gMzvy0htC+heU01:DfdqaaC/12G2bHZokO+/36
MD5:	18B352E2051962B9F65C33BC651426BF
SHA1:	3DD8D93CF7695D1C9D7574751AB5B0DEE5DD7F9A
SHA-256:	8215C54EAD77D9DC5A108A25C6BDC72B5999AA6F62C9499A440359412AFA5A51
SHA-512:	D966BC2899079C0D9AC763C96EA59A550E00A54BDCEEB6D96B0A8CAA9F6A1C408E7E3946915432978EDE9EDF669EEC68035A55B094B69671A28428458760D99E
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: backports.tarfile.Version: 1.2.0.Summary: Backport of CPython tarfile module.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/backports.tarfile.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest !=8.1.*,>=6 ; extra == 'testing'.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'testing'.Requires-Dist: pytest-cov ; extra == 'testing

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	5.753738299642538
Encrypted:	false
SSDEEP:	24:U6rn/2zDJ6rvbqfuG6rJnB6rU6rEsJYB6rXamx6rlCHmTKjaQliwxJlp5DQljQls:NnuXIzUurJwN5JjfAlqYK9liSlp5DQlP
MD5:	CF347AE8E31132435B127226F358F8CD
SHA1:	2C857B300638FF291651234BBB2C077BEEF494E4
SHA-256:	258A1F1C849E1175069A55A5D6CE357AFDD04E34CD5DE27093E4ACEC7A9D2CE1
SHA-512:	2A46C7FDFA2F9883BB1D761646B33BE9CE7B07280A5BF38992C1C84AB0449944EB0CAF34620CCC82DDBBC193F0D54AE67797D97863F70CA0C24EE55A3B401F9C
Malicious:	false
Preview:	backports.tarfile-1.2.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..backports.tarfile-1.2.0.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..backports.tarfile-1.2.0.dist-info/METADATA,sha256=ghXFTq132dxaEIolxr3HK1mZqm9iyUmaRANZQSr6WlE,2020..backports.tarfile-1.2.0.dist-info/RECORD,,..backports.tarfile-1.2.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..backports.tarfile-1.2.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..backports.tarfile-1.2.0.dist-info/top_level.txt,sha256=cGjaLMOoBR1FK0ApojtzWVmViTtJ7JGIK_HwXiEsvtU,10..backports/__init__.py,sha256=iOEMwnlORWezdO8-2vxBIPSR37D7JGjluZ8f55vzxls,81..backports/__pycache__/__init__.cpython-312.pyc,,..backports/tarfile/__init__.py,sha256=Pwf2qUIfB0SolJPCKcx3vz3UEu_aids4g4sAfxy94qg,108491..backports/tarfile/__main__.py,sha256=Yw2oGT1afrz2eBskzdPYL8ReB_3liApmhFkN2EbDmc4,59..backports/tarfile/__pycache__/__init__.cpython-312.pyc,,..back

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:21v:ev
MD5:	9BA458821AD258B6EF62B47E91302982
SHA1:	9EDB9E6BA5C4001CE2FCCF328739292404EA9604
SHA-256:	7068DA2CC3A8051D452B4029A23B73595995893B49EC91882BF1F05E212CBED5
SHA-512:	3A296E5DADD5B406330BA088BFED33BE6960F8FF42DB6651E185FF14F2272FC819EF520D1A15BC40DA4E20B9CA0E5D79170EDF33F3D50937C7FBEDB338CAC730
Malicious:	false
Preview:	backports.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	5.006900644756252
Encrypted:	false
SSDEEP:	96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
MD5:	98ABEAACC0E0E4FC385DFF67B607071A
SHA1:	E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
SHA-256:	6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
SHA-512:	F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.6307766747793275
Encrypted:	false
SSDEEP:	48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
MD5:	EB513CAFA5226DDA7D54AFDCC9AD8A74
SHA1:	B394C7AEC158350BAF676AE3197BEF4D7158B31C
SHA-256:	0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
SHA-512:	A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
Malicious:	false
Preview:	importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.687870576189661
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
MD5:	7D09837492494019EA51F4E97823D79F
SHA1:	7829B4324BB542799494131A270EC3BDAD4DEDEF
SHA-256:	9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
SHA-512:	A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_resources-6.4.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_resources-6.4.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_resources-6.4.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3944
Entropy (8bit):	5.015824473130961
Encrypted:	false
SSDEEP:	96:DHxQuiTaCP1nTGDbHRbnzQWHaiQq+fT5lWp8sSwTW:2PP9GDbHRbnp+rapPSwTW
MD5:	C3EB48CD13B50DDED7CD524E1E9DD4CE
SHA1:	7C9B0B50D0E667825DAB09902AD8376A5F2945B6
SHA-256:	83878CD8BB8BD0E89971454D0F4AB00C9529136F603AFB4EDC148F5D36CEF459
SHA-512:	056EBC250B7E82F91B5C5E96B1293F24D5E917E06846A9716A4D05B47C30FEB3781E439C77876CF7D8620BEBAA4A253039CA8DF122283DE304992E340F4DE8BF
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_resources.Version: 6.4.0.Summary: Read resources from Python packages.Home-page: https://github.com/python/importlib_resources.Author: Barry Warsaw.Author-email: barry@python.org.Project-URL: Documentation, https://importlib-resources.readthedocs.io/.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.License-File: LICENSE.Requires-Dist: zipp >=3.1.0 ; python_version < "3.10".Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: sphinx <7.2.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; ext

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_resources-6.4.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	7620
Entropy (8bit):	5.560551717923108
Encrypted:	false
SSDEEP:	192:lX7qdX7ZgsP7JtILSVAn5V26+XuVYmBXx:lX7wX7ZBP7ELSVAni6+iBh
MD5:	67F5E26385B6BDCF2236A005A2D2BA32
SHA1:	3DCD8685638A90D121FD484138AFCAC9775E5D66
SHA-256:	967DD56FEEA143F1D2C4E98AC1F937C055E61C9AA0425146D55F7AD7C82510FA
SHA-512:	30B5812E930A00A476E570EBCC4611D54C911A8B1E4646949A887F551FC5ABDC933311A554B197C602F0DA7626DFE8877A3F267EFBC6D724E24A3E9B5FCC2E30
Malicious:	false
Preview:	importlib_resources-6.4.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_resources-6.4.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_resources-6.4.0.dist-info/METADATA,sha256=g4eM2LuL0OiZcUVND0qwDJUpE29gOvtO3BSPXTbO9Fk,3944..importlib_resources-6.4.0.dist-info/RECORD,,..importlib_resources-6.4.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_resources-6.4.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..importlib_resources-6.4.0.dist-info/top_level.txt,sha256=fHIjHU1GZwAjvcydpmUnUrTnbvdiWjG4OEVZK8by0TQ,20..importlib_resources/__init__.py,sha256=uyp1kzYR6SawQBsqlyaXXfIxJx4Z2mM8MjmZn8qq2Gk,505..importlib_resources/__pycache__/__init__.cpython-312.pyc,,..importlib_resources/__pycache__/_adapters.cpython-312.pyc,,..importlib_resources/__pycache__/_common.cpython-312.pyc,,..importlib_resources/__pycache__/_itertools.cpython-312.pyc,,..importlib_resource

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_resources-6.4.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\importlib_resources-6.4.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:JSe8AW6D:3fD
MD5:	0613840F692BD9E064FEDD915DFD477A
SHA1:	64DF38B36F541BA1714C15FCA1A9CA8C94EF2DAA
SHA-256:	7C72231D4D46670023BDCC9DA6652752B4E76EF7625A31B83845592BC6F2D134
SHA-512:	78AA888C24B3468C94FCB8EB882561D4B6F19A0537A4CFDDDFF94ED8A4BAFE8DF0C2B620E70B57A61E8BA3F877856DB9ADA548DFCA8CAE86D4C3C525A4E9B7EB
Malicious:	false
Preview:	importlib_resources.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\inflect-7.3.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\inflect-7.3.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\inflect-7.3.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21079
Entropy (8bit):	5.103530371859935
Encrypted:	false
SSDEEP:	384:12Vpnu38/2K9tjUaNtT/yTCtYTnWDdg3GaXb51KLVgWTVPeEGsuPrAESM:12Vpnu38JZtT/yIdg3D51KLV7RPeEGs+
MD5:	1A287FAF08B125BC7C932AAD05E7DAEE
SHA1:	C37042ADC0D1270485F4B8B5B9E085A274DC035B
SHA-256:	66030D634580651B3E53CC19895D9231F8D22AA06B327817C8332CFC20303308
SHA-512:	D0BB0AD27A17007DF7D3281FB2F46EFB048B69532D082AB1D431E0BA28E592D897687708B4EC972F4BC21EDA29DDDDC9EF44BB950DFC4FFB03EA75CDA4DE414C
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: inflect.Version: 7.3.1.Summary: Correctly generate plurals, singular nouns, ordinals, indefinite articles.Author-email: Paul Dyson <pwdyson@yahoo.com>.Maintainer-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/jaraco/inflect.Keywords: plural,inflect,participle.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Natural Language :: English.Classifier: Operating System :: OS Independent.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: Text Processing :: Linguistic.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: more-itertools >=8.5.0.Requires-Dist: typeguard >=4.0.1.Requires-Dist: typing-extensions ; python_version < "3.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\inflect-7.3.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.828988691860191
Encrypted:	false
SSDEEP:	24:IVn/2zDPvbqfuIpBntmuIcjlM+sVGXdbkDcnJopDvDK16bZWJV:unuXPzUuIpRtmuZjl9sVQgcnJo9bK16E
MD5:	C837BB3258448B7FCC6B77559C7F17B6
SHA1:	B15701449CD64A13756A70AD3704E26DB1FF416B
SHA-256:	5D7834AC1BA2612C6801050FDE57A7B98B0F36ACF88C3C2D4F376FD8911B3091
SHA-512:	2333CD86502C51607414390ECF43BD6D62E863D3DFB0501DAD3A8B45F5F4DFA81F910917183FC4F4A0DEEC82C8F8B3CF8D5B0A2C136DEB164226BABE68B74A33
Malicious:	false
Preview:	inflect-7.3.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..inflect-7.3.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..inflect-7.3.1.dist-info/METADATA,sha256=ZgMNY0WAZRs-U8wZiV2SMfjSKqBrMngXyDMs_CAwMwg,21079..inflect-7.3.1.dist-info/RECORD,,..inflect-7.3.1.dist-info/WHEEL,sha256=y4mX-SOX4fYIkonsAGA5N0Oy-8_gI4FXw5HNI1xqvWg,91..inflect-7.3.1.dist-info/top_level.txt,sha256=m52ujdp10CqT6jh1XQxZT6kEntcnv-7Tl7UiGNTzWZA,8..inflect/__init__.py,sha256=Jxy1HJXZiZ85kHeLAhkmvz6EMTdFqBe-duvt34R6IOc,103796..inflect/__pycache__/__init__.cpython-312.pyc,,..inflect/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..inflect/compat/__pycache__/__init__.cpython-312.pyc,,..inflect/compat/__pycache__/py38.cpython-312.pyc,,..inflect/compat/py38.py,sha256=oObVfVnWX9_OpnOuEJn1mFbJxVhwyR5epbiTNXDDaso,160..inflect/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\inflect-7.3.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.7098485981676825
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLKSgP+tPCCfA5S:RtC1VLKZWBBf
MD5:	EB46A94D39AC40E2EEA4A32729E0C8C3
SHA1:	E42EF49A7098269E1934932ECC3174B40967982A
SHA-256:	CB8997F92397E1F6089289EC0060393743B2FBCFE0238157C391CD235C6ABD68
SHA-512:	D89F0DA16AA37AAFAC0DE56A3DFBD72DC3C9DCC53C8E455094E7230DB21ABF95ED76EAC1848A4156DB422B9C10BE136201D871DCCB73AD38192E5536E41DBDFE
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.2.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\inflect-7.3.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:KDpJ:K9J
MD5:	4571281D24750CBE7638EFE250E342AB
SHA1:	61E8A0AD5796F1CA67EAB0D8108A6402483D499B
SHA-256:	9B9DAE8DDA75D02A93EA38755D0C594FA9049ED727BFEED397B52218D4F35990
SHA-512:	E7807002E53CC228D6EFB307E928C6737796B29E31D25A342ED407F556FFBF540494FE92C27B5C31043D2D7FF427C78A29C4FF5595BC11BB643003026642254E
Malicious:	false
Preview:	inflect.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.context-5.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.context-5.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.context-5.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text, with very long lines (406)
Category:	dropped
Size (bytes):	4020
Entropy (8bit):	4.99859161164956
Encrypted:	false
SSDEEP:	96:D6P4YaCP1gGRbHneRohWYc+f/PCnG9rulJQ84UNxCUSwTcL:kPqGRbHneRohWJ+XPaqylW/USwTcL
MD5:	812F27A7C8C748351DC1643D58B6B250
SHA1:	AC9C92013B2F0FC65D741B32A9FE4B956DD6EB7D
SHA-256:	C43B60B897A3D2D37D8845C252FC44261D9AEF171E21154111A9012D2AFFFED6
SHA-512:	CAC62C3682F808D85233B69F1C142B5A0E95E316E4BDCBC6EE253583EC302FA42E635BAB6A837327D8CE5D26C08C8DCD9E45D5CFDD8346B4501C473250D66953
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: jaraco.context.Version: 5.3.0.Summary: Useful decorators and context managers.Home-page: https://github.com/jaraco/jaraco.context.Author: Jason R. Coombs.Author-email: jaraco@jaraco.com.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.License-File: LICENSE.Requires-Dist: backports.tarfile ; python_version < "3.12".Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest !=8.1.1,>=6 ; extra == 'testing'.Requires-Dist: pytest-checkdocs >=2.4

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.context-5.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	641
Entropy (8bit):	5.76835538630355
Encrypted:	false
SSDEEP:	12:TGA0a/2zDJAv/TnqfQlWJAL/fy9vKAGvAXCaaryBAl2VrkEQCXvbAT2r1S:TBn/2zDCvbqfuLO9FGoXamalKSCXzB1S
MD5:	2B0A77624AE3903E42C3A8213E593796
SHA1:	D63027FF018995D0620E2497BCE9678888A57667
SHA-256:	55197B88A78443297BB2D827A75BAAE740B33896251D872835D4B4C75EC2F57E
SHA-512:	C02FB1554F8F40158BB60F2B4EC07D80F71CFBFFB38463C5809385A7A2FF8DDB2BDFEFE9AE5E67F4DEC3D904A6E0925E565B0EE6363DD0C2ED5B03A96B056B18
Malicious:	false
Preview:	jaraco.context-5.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.context-5.3.0.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.context-5.3.0.dist-info/METADATA,sha256=xDtguJej0tN9iEXCUvxEJh2a7xceIRVBEakBLSr__tY,4020..jaraco.context-5.3.0.dist-info/RECORD,,..jaraco.context-5.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.context-5.3.0.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/__pycache__/context.cpython-312.pyc,,..jaraco/context.py,sha256=REoLIxDkO5MfEYowt_WoupNCRoxBS5v7YX2PbW8lIcs,9552..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.context-5.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.context-5.3.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:GEG0:GEG0
MD5:	0BA8D736B7B4AB182687318B0497E61E
SHA1:	311BA5FFD098689179F299EF20768EE1A29F586D
SHA-256:	D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
SHA-512:	7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
Malicious:	false
Preview:	jaraco.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2891
Entropy (8bit):	5.034580807599395
Encrypted:	false
SSDEEP:	48:DEmbsaC3J1x9Ie9okNGwQw8wQw2wTw0zCPU0+I65Jib0H++kv0gM5d0DT+heU04u:DEmgaCZ1nTGDbHRAnzpI6o+fX5dFSwTm
MD5:	C2E6BDA7F1B03B39BF42D31B6DBF6C38
SHA1:	B7A18F079DE22D10C4C318E54BD8C48177F91333
SHA-256:	8B86946900D7FA38DD1102B9C1EBE17A0CB1F09C8B7E29F61F2BDA4A4DC51ECA
SHA-512:	F4E892B3D41482E3B17642B1D722B6E2A8E8DD4833F0623C29ED2D50D55CFC68DA1F9756B4E08723DC89F3E552424096C92912AC4DA533FE8E2DC59DC19EA9CF
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: jaraco.functools.Version: 4.0.1.Summary: Functools like those found in stdlib.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/jaraco.functools.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: more-itertools.Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: sphinx <7.2.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'docs'.Provides-Extra: testing.Requires-Dist: pytest >=6 ;

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.807846597836061
Encrypted:	false
SSDEEP:	24:Tmn/2zDRvbqfuggoaGnXamZlKZBX3vpBvt+c0X4yWJV:TmnuXRzUuggDifZlmX/aWJV
MD5:	85FB54BAFB143CD57D1787F7EF74FDB2
SHA1:	A915BBCDF108A58F3DFC1783D9D4DD3B7F3CE23A
SHA-256:	632AA7C04F7C4BCC01C027AF5B9BC76FE8958F4A181035B957A3BD3014BA248B
SHA-512:	2A39B4C6F221F88EC61D584C8CD3CAD358E8C7B50E529192105A0A4144ED3C2A4CE8B630C39C18D20E27FE226A23E2DE23CDFF8E3D3693959B165A9A2F9047CD
Malicious:	false
Preview:	jaraco.functools-4.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.functools-4.0.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.functools-4.0.1.dist-info/METADATA,sha256=i4aUaQDX-jjdEQK5wevhegyx8JyLfin2HyvaSk3FHso,2891..jaraco.functools-4.0.1.dist-info/RECORD,,..jaraco.functools-4.0.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.functools-4.0.1.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/functools/__init__.py,sha256=hEAJaS2uSZRuF_JY4CxCHIYh79ZpxaPp9OiHyr9EJ1w,16642..jaraco/functools/__init__.pyi,sha256=gk3dsgHzo5F_U74HzAvpNivFAPCkPJ1b2-yCd62dfnw,3878..jaraco/functools/__pycache__/__init__.cpython-312.pyc,,..jaraco/functools/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:GEG0:GEG0
MD5:	0BA8D736B7B4AB182687318B0497E61E
SHA1:	311BA5FFD098689179F299EF20768EE1A29F586D
SHA-256:	D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
SHA-512:	7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
Malicious:	false
Preview:	jaraco.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3658
Entropy (8bit):	5.02710641474483
Encrypted:	false
SSDEEP:	96:DYMaCFS802Vpnu388Ksc+fIybwFiR8g6RSwTsL:pFz02Vpnu388KB+gybwgRd6RSwTsL
MD5:	70FE732EDE8F8E6C84DA4EA21D4933E5
SHA1:	A7763789FA56CEBBAA849368FAAC7D386F170399
SHA-256:	03359D9BA56231F0CE3E840C7CB5A7DB380141218949CCAA78DDBD4DCB965D52
SHA-512:	4C8D3D5078840BD4DBE20458EBF52890585C5911C22C3EFCE2FB28985461BC80469339DDAF6016FB099C84BDF9B41A26FF1884B456422A8D0C682104D7950D91
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: jaraco.text.Version: 3.12.1.Summary: Module for text manipulation.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/jaraco.text.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: jaraco.functools.Requires-Dist: jaraco.context >=4.1.Requires-Dist: autocommand.Requires-Dist: inflect.Requires-Dist: more-itertools.Requires-Dist: importlib-resources ; python_version < "3.9".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1500
Entropy (8bit):	5.794249493238335
Encrypted:	false
SSDEEP:	24:TkLFn/2zDVLFvbqfuaLFo2kXLFGnLFEsJiLFXamdLFlKbkZ6d3JpPXu/1XWXYXw2:TcnuXDzUuuCw5Jmfblyz3Jp2/NUsM0bN
MD5:	39FCCE64BC768C2046067E4AAD8465F0
SHA1:	2EFC0FC776576A8FE01BBACD0760A49EEE6481DA
SHA-256:	816D945741DCA246099388CA3EED74FC0667ACBAA36F70B559B2494C3979B1F6
SHA-512:	FB2335A6675F9CADEEE38B666FAB9EA1D8BFBA6B7768253D42F44149591A3239F4B2FA19DDF2C282DC7E47A01D7DCA69AADBBCDAC9107EDBCB2C22D11BA81287
Malicious:	false
Preview:	jaraco.text-3.12.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..jaraco.text-3.12.1.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..jaraco.text-3.12.1.dist-info/METADATA,sha256=AzWdm6ViMfDOPoQMfLWn2zgBQSGJScyqeN29TcuWXVI,3658..jaraco.text-3.12.1.dist-info/RECORD,,..jaraco.text-3.12.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..jaraco.text-3.12.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..jaraco.text-3.12.1.dist-info/top_level.txt,sha256=0JnN3LfXH4LIRfXL-QFOGCJzQWZO3ELx4R1d_louoQM,7..jaraco/text/Lorem ipsum.txt,sha256=N_7c_79zxOufBY9HZ3yzMgOkNv-TkOTTio4BydrSjgs,1335..jaraco/text/__init__.py,sha256=Y2YUqXR_orUoDaY4SkPRe6ZZhb5HUHB_Ah9RCNsVyho,16250..jaraco/text/__pycache__/__init__.cpython-312.pyc,,..jaraco/text/__pycache__/layouts.cpython-312.pyc,,..jaraco/text/__pycache__/show-newlines.cpython-312.pyc,,..jaraco/text/__pycache__/strip-prefix.cpython-312.pyc,,..jaraco/text/__py

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco.text-3.12.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:GEG0:GEG0
MD5:	0BA8D736B7B4AB182687318B0497E61E
SHA1:	311BA5FFD098689179F299EF20768EE1A29F586D
SHA-256:	D099CDDCB7D71F82C845F5CBF9014E18227341664EDC42F1E11D5DFE5A2EA103
SHA-512:	7CCCBB4AFA2FADE40D529482301BEAE152E0C71EE3CC41736EB19E35CFC5EE3B91EF958CF5CA6B7330333B8494FEB6682FD833D5AA16BF4A8F1F721FD859832C
Malicious:	false
Preview:	jaraco.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\more_itertools-10.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\more_itertools-10.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1053
Entropy (8bit):	5.0945274555157285
Encrypted:	false
SSDEEP:	24:arOJH7H0yxgtUHw1hC09QHOsUv4eOk4/+/m3oqLFh:aSJrlxEvdQHOs5exm3ogFh
MD5:	3396EA30F9D21389D7857719816F83B5
SHA1:	0D43A836DAC65C0EA426AD49C881A1086600BF85
SHA-256:	09F1C8C9E941AF3E584D59641EA9B87D83C0CB0FD007EB5EF391A7E2643C1A46
SHA-512:	D43092223392EDDA3BD777625F5BF54ACB0CC00C25555A4F8A16DB9CCDAFC380D3204486CB2A5FDC9D3F9E459B1FED948FFC7000AA0E40F37B807A01F4421294
Malicious:	false
Preview:	Copyright (c) 2012 Erik Rose..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WITH THE SO

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\more_itertools-10.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	36293
Entropy (8bit):	3.717596190655759
Encrypted:	false
SSDEEP:	384:bs9cnyPtWIRmL0QnCHx4Zi3XBB9GcF89oi+odVBqCv9d3m24TeYH5AvDpG27IFf5:Ua+H1Nsg/
MD5:	5BA05B51B603386707E1E3A101CDD6B3
SHA1:	FFCCEC7FD799CC4AB07530954FEF3BE2472E2C23
SHA-256:	0453BDD0EF9F2CD89540CA63EE8212E73B73809514419DD3037D8FE471F737E0
SHA-512:	FE7F7D6B6C8089B09A18930EF462BA4C7A15EAF6D3E8610AC655ECADE16CE31D9C01ECE84C88A3C2D9DD34DE70E194A020E28179CF33B21389EE3EEFC7229B74
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: more-itertools.Version: 10.3.0.Summary: More routines for operating on iterables, beyond itertools.Keywords: itertools,iterator,iteration,filter,peek,peekable,chunk,chunked.Author-email: Erik Rose <erikrose@grinchcentral.com>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Natural Language :: English.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: Py

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\more_itertools-10.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1259
Entropy (8bit):	5.794423512787632
Encrypted:	false
SSDEEP:	24:Bhxn/2zDahxvIhxphxBhxEsJXhxzvXiCflBJRHXoggtqgmf7WJhmsxmwG:hnuXwOph5J3zvXi4Lo7qgQ7WJhS
MD5:	178EE325409DD28809AD3661E8819EF8
SHA1:	F5844FAC6E3C9133FE5F1B8195EE801959801DF3
SHA-256:	77C8E73E018DC0FD7E9ED6C80B05A4404545F641FB085220CE42B368B59AA3D3
SHA-512:	2DB06B622F644674BF7D7AD8B780F9802858D15D73B5075139C2D82181DD6D589B90172BCA7AE9C785E705F447F523DB2AE641826C550C599551A7D8C2396FC2
Malicious:	false
Preview:	more_itertools-10.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..more_itertools-10.3.0.dist-info/LICENSE,sha256=CfHIyelBrz5YTVlkHqm4fYPAyw_QB-te85Gn4mQ8GkY,1053..more_itertools-10.3.0.dist-info/METADATA,sha256=BFO90O-fLNiVQMpj7oIS5ztzgJUUQZ3TA32P5HH3N-A,36293..more_itertools-10.3.0.dist-info/RECORD,,..more_itertools-10.3.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..more_itertools-10.3.0.dist-info/WHEEL,sha256=rSgq_JpHF9fHR1lx53qwg_1-2LypZE_qmcuXbVUq948,81..more_itertools/__init__.py,sha256=dtAbGjTDmn_ghiU5YXfhyDy0phAlXVdt5klZA5fUa-Q,149..more_itertools/__init__.pyi,sha256=5B3eTzON1BBuOLob1vCflyEb2lSd6usXQQ-Cv-hXkeA,43..more_itertools/__pycache__/__init__.cpython-312.pyc,,..more_itertools/__pycache__/more.cpython-312.pyc,,..more_itertools/__pycache__/recipes.cpython-312.pyc,,..more_itertools/more.py,sha256=1E5kzFncRKTDw0cYv1yRXMgDdunstLQd1QStcnL6U90,148370..more_itertools/more.pyi,sha256=iXXeqt48Nxe8VGmIWpkVXuKpR2FYNuu2DU8nQL

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\more_itertools-10.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFML6KjP+tPCCfA5I:Rt1QqL6gWBB3
MD5:	FE76A5D309B5416824C2034FBF8A16CD
SHA1:	5975EB6043863B0D018A5D751293F38E0B8E2874
SHA-256:	AD282AFC9A4717D7C7475971E77AB083FD7ED8BCA9644FEA99CB976D552AF78F
SHA-512:	6E4610171DD4E7E49FB4570CF3562D26A4F171FF67DA0F3A259A77916ACB939C8FCA7DA9F473EFAD839947796AC8CD7385DAA3264ADB150FF131A5C0FAC9329C
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.8.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\packaging-24.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\packaging-24.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.510719529760597
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreBNA2eBKmJozlMHuO:h9Co8FyQjkDYc5tWreBN0n2mH1
MD5:	FAADAEDCA9251A90B205C9167578CE91
SHA1:	ED1FCABA1DBBF55113ABB419A484F3DF63E7ECFC
SHA-256:	CAD1EF5BD340D73E074BA614D26F7DEACA5C7940C3D8C34852E65C4909686C48
SHA-512:	1E69C89558FFE39E5C1EBB6728C4F0EB6023563C7A7F31B5417A8EFCC906378D2E2AF7B0E06A66980FBAAB7996AEB2AE1EA3918FDBE5FFCC3F77EA888A68EFBC
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to this software is made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\packaging-24.1.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10174
Entropy (8bit):	4.3908324771089084
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
MD5:	2EE41112A44FE7014DCE33E26468BA93
SHA1:	598F87F072F66E2269DD6919292B2934DBB20492
SHA-256:	0D542E0C8804E39AA7F37EB00DA5A762149DC682D7829451287E11B938E94594
SHA-512:	27B8C0252EAE50CA3CE02AB7C5670664C0C824E03EB3DA1089F3F0A00D23E648A956BCB9F53645C6D79674A87C4CC86D1085DC335911BE0210D691336B121857
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\packaging-24.1.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	5.070827944686827
Encrypted:	false
SSDEEP:	24:fjUnoorbOFFTJJyRrYFTjz796432s4EOkUs8gROF32s3yTtTf413tf9fsZlTHv:fkOFJSrYJR6432svI32s3Stc13tfyTHv
MD5:	7BEF9BF4A8E4263634D0597E7BA100B8
SHA1:	FDC0E4EABC45522B079DEFF7D03D70528D775DC0
SHA-256:	B70E7E9B742F1CC6F948B34C16AA39FFECE94196364BC88FF0D2180F0028FAC5
SHA-512:	96C3273D51B83B6AE1AB85FEFB814DCD6C1E60D311D412242405AA429CC860412477CBD6ECE171408DBB85F0C4FD742E3AF20C758015BC48406AA65A1AB6F60A
Malicious:	false
Preview:	Copyright (c) Donald Stufft and individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE.FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL.DAMAGES (INCLUDING, BUT NOT LIM

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\packaging-24.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3204
Entropy (8bit):	4.9859857663557925
Encrypted:	false
SSDEEP:	96:DRKnOkaMktjaVMxsxCp5QXFfFKiYEvA9TzBnyD:psZfFhgXNG
MD5:	3236C0D7091D4A6577FA30E061480CEC
SHA1:	F99865B8D3B90AD64A0060F7F2F4C6E4FAEB0A39
SHA-256:	5F7A283B75A709FCCD481AEA42379F083D4F3801753365922E6B0732042515D9
SHA-512:	A9F0BC43A135732510B98E9C0B7F997D9557A6069352372F1AC3216F0E66FA617D9597990904935D58E5139FB34E17995BFA8B95B90C71997206A2B6955FE867
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: packaging.Version: 24.1.Summary: Core utilities for Python packages.Author-email: Donald Stufft <donald@stufft.io>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Language :: Python :: 3.13.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\packaging-24.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2565
Entropy (8bit):	5.780503861671858
Encrypted:	false
SSDEEP:	48:bsnuXksXW2Bsv8VsQ7lEsahOsbs5Jhsde8UogvtJkHpHAfEcysrD5WJeCzESowj:vXrW2s8JsMdVogvtJkJgfksP5qeCzOwj
MD5:	88FBF3C6BD08040482212DAD5A8EAB02
SHA1:	E7EE66942F7321FB77888D492D57C2EEEA1A5171
SHA-256:	38A6898306293627C81E2B2D8A93E5F6857D5F7EDB73F0334E8D9A53DAD53B6E
SHA-512:	786AE1F883A999A0939C22A756F90D74CC7F87AAF13F6FFF22D8D962D213A1ECBC6AAE2890A5D7347487824CD0E9EB440A3923F01F938EEF068719DFEEE96554
Malicious:	false
Preview:	packaging-24.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..packaging-24.1.dist-info/LICENSE,sha256=ytHvW9NA1z4HS6YU0m996spceUDD2MNIUuZcSQlobEg,197..packaging-24.1.dist-info/LICENSE.APACHE,sha256=DVQuDIgE45qn836wDaWnYhSdxoLXgpRRKH4RuTjpRZQ,10174..packaging-24.1.dist-info/LICENSE.BSD,sha256=tw5-m3QvHMb5SLNMFqo5_-zpQZY2S8iP8NIYDwAo-sU,1344..packaging-24.1.dist-info/METADATA,sha256=X3ooO3WnCfzNSBrqQjefCD1POAF1M2WSLmsHMgQlFdk,3204..packaging-24.1.dist-info/RECORD,,..packaging-24.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..packaging-24.1.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..packaging/__init__.py,sha256=dtw2bNmWCQ9WnMoK3bk_elL1svSlikXtLpZhCFIB9SE,496..packaging/__pycache__/__init__.cpython-312.pyc,,..packaging/__pycache__/_elffile.cpython-312.pyc,,..packaging/__pycache__/_manylinux.cpython-312.pyc,,..packaging/__pycache__/_musllinux.cpython-312.pyc,,..packaging/__pycache__/_parser.cpython-312.pyc,,

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\packaging-24.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\platformdirs-4.2.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\platformdirs-4.2.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11429
Entropy (8bit):	5.039575520713946
Encrypted:	false
SSDEEP:	192:n9x/tlCtlsaCUpVQ7yHwgNF8NFvWVDM1RnzadSibNTTh+fOnnxa6jlES4h8a8KAH:3/tlCfsqpq7ydZzM0dGiCbvHcjNj61TA
MD5:	12306075DF09A0DBB93315FADDDF73FB
SHA1:	1AC8A3679AFCFEEC0BA00851F5F8095DD1B060CD
SHA-256:	CE6B227B4D46D4CB57474C2022FE57A557933BB89DAF4596BDF9B12AC296B869
SHA-512:	BA0A72B888A14F82FD44FB103C01EF0900B5302F18E986A8264A9A08AB77D1C655C392374FD7B0A98BEF9B9511F6EC78AF3EF8936091C80A0B5364F7A53DC20A
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: platformdirs.Version: 4.2.2.Summary: A small Python package for determining appropriate platform-specific dirs, e.g. a `user data dir`..Project-URL: Documentation, https://platformdirs.readthedocs.io.Project-URL: Homepage, https://github.com/platformdirs/platformdirs.Project-URL: Source, https://github.com/platformdirs/platformdirs.Project-URL: Tracker, https://github.com/platformdirs/platformdirs/issues.Maintainer-email: Bern.t G.bor <gaborjbernat@gmail.com>, Julian Berman <Julian@GrayVines.com>, Ofek Lev <oss@ofek.dev>, Ronny Pfannschmidt <opensource@ronnypfannschmidt.de>.License-Expression: MIT.License-File: LICENSE.Keywords: appdirs,application,cache,directory,log,user.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\platformdirs-4.2.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.780720255872038
Encrypted:	false
SSDEEP:	24:bn/2zDzoobEsJhfPWcs013+pj456szN6lnhta57WJ+guQg4:bnuXcob5Jhfucs+d49hta9WJ+g1X
MD5:	0E141A28570FC62974FC5CEADFE808E3
SHA1:	7B92561C5BBBA83D6E16A1C7B195089ACA1766AF
SHA-256:	4C211D76D42ED40EFC3ACFCC866D8912A718AFBCA2B7E51849442366D6E99FE8
SHA-512:	830721C18A35AECD1EFB81A5FAAF8AC0EA02428EDC5B294458556343788D894B76035F1E661214D975DF2A64DC8C3D6AAA7A53A99BE64B9413B6A5D89D549F9D
Malicious:	false
Preview:	platformdirs-4.2.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..platformdirs-4.2.2.dist-info/METADATA,sha256=zmsie01G1MtXR0wgIv5XpVeTO7idr0WWvfmxKsKWuGk,11429..platformdirs-4.2.2.dist-info/RECORD,,..platformdirs-4.2.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..platformdirs-4.2.2.dist-info/WHEEL,sha256=zEMcRr9Kr03x1ozGwg5v9NQBKn3kndp6LSoSlVg-jhU,87..platformdirs-4.2.2.dist-info/licenses/LICENSE,sha256=KeD9YukphQ6G6yjD_czwzv30-pSHkBHP-z0NS-1tTbY,1089..platformdirs/__init__.py,sha256=EMGE8qeHRR9CzDFr8kL3tA8hdZZniYjXBVZd0UGTWK0,22225..platformdirs/__main__.py,sha256=HnsUQHpiBaiTxwcmwVw-nFaPdVNZtQIdi1eWDtI-MzI,1493..platformdirs/__pycache__/__init__.cpython-312.pyc,,..platformdirs/__pycache__/__main__.cpython-312.pyc,,..platformdirs/__pycache__/android.cpython-312.pyc,,..platformdirs/__pycache__/api.cpython-312.pyc,,..platformdirs/__pycache__/macos.cpython-312.pyc,,..platformdirs/__pycache__/unix.cpython-312.pyc,,..platformdirs/__p

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\platformdirs-4.2.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.730668933656452
Encrypted:	false
SSDEEP:	3:RtEeXAaCTR73RP+tPCCfA5I:Rt2PFRWBB3
MD5:	8895639B8515B3094302B59E28AFB562
SHA1:	FBD4DA759EA5BEB65AE820DFBC47F9B569E89519
SHA-256:	CC431C46BF4AAF4DF1D68CC6C20E6FF4D4012A7DE49DDA7A2D2A1295583E8E15
SHA-512:	B53C0978DAD2A7195058ABC7B7D20A229EC617BDDBB364D8ED2354F37D5071208735774350F9FBBA5C804BEFCEFE71C27BC5E468E12899DF4687189C468785A0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: hatchling 1.24.2.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\platformdirs-4.2.2.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.119723466133474
Encrypted:	false
SSDEEP:	24:VrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:VaJHlxE3dQHOs5exm3ogFh
MD5:	EA4F5A41454746A9ED111E3D8723D17A
SHA1:	F511A8A63AF8C6E36004B593478436BBC560EE0C
SHA-256:	29E0FD62E929850E86EB28C3FDCCF0CEFDF4FA94879011CFFB3D0D4BED6D4DB6
SHA-512:	CACA68A5589CA2EAB7C0D74BA5D2B25E3367B9902DFC7578BBA911AC8F8BF1C3A13F25E663C5B6B19BA71BF611943E23F4D0A99BE92A8F7D7FF60732DC3DD409
Malicious:	false
Preview:	MIT License..Copyright (c) 2010-202x The platformdirs developers..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\tomli-2.0.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\tomli-2.0.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1072
Entropy (8bit):	5.10135495500641
Encrypted:	false
SSDEEP:	24:f9rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:1aJHlxE3dQHOs5exm3ogFh
MD5:	AAAAF0879D17DF0110D1AA8C8C9F46F5
SHA1:	9DA6CA26337A886FB3E8D30EFD4AEDA623DC9ADE
SHA-256:	B80816B0D530B8ACCB4C2211783790984A6E3B61922C2B5EE92F3372AB2742FE
SHA-512:	EECD0C29FEBF51ADEFB02F970E66EFE7E24D573686DFDB3BEEA63CEFEA012A79CE3C49A899B4F26E9B67DC27176B397F6041909227281F9866BEEDC97389095C
Malicious:	false
Preview:	MIT License..Copyright (c) 2021 Taneli Hukkinen..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CON

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\tomli-2.0.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8875
Entropy (8bit):	4.884349533695185
Encrypted:	false
SSDEEP:	192:h15VsahrDzoGlmLxUJyLIPXR/yrKK3Trclclg2pj4VRR6V8wNVonQd:3swrAamWuIPA2K3v2g
MD5:	CBBF7047A51FEDA58386E86182B85B8A
SHA1:	D3EA3BDA227794AE35FE7FFC5BD6E5FA2A5EF250
SHA-256:	CCF0DC78A98FC0918B5AD67292B1E2C4BED65575A6246CD9D63C914F9942A0F2
SHA-512:	A994914F1676790730C6BDACA26FE5F1B18BA9A3B9F0D24D708C722424DED255360A0CC88E239C6BFE467BD2763DF7339BB6B760AB090FAE474A7C9C8AFA8948
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: tomli.Version: 2.0.1.Summary: A lil' TOML parser.Keywords: toml.Author-email: Taneli Hukkinen <hukkin@users.noreply.github.com>.Requires-Python: >=3.7.Description-Content-Type: text/markdown.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: MacOS.Classifier: Operating System :: Microsoft :: Windows.Classifier: Operating System :: POSIX :: Linux.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: PyPy.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Typing :: Typed.Project-URL: Changelog, https://github.com/hukkin/tomli/blob/master/CHANGELOG.md.Project-URL:

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\tomli-2.0.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	999
Entropy (8bit):	5.89030761653127
Encrypted:	false
SSDEEP:	24:4n/2zDRv53Pb4EsJWc6QtD8r8N8bh8WNdop2+oM8+kzAL5+1:4nuXR1Pb45JWc6QmIebKWcpHoM8JMLy
MD5:	D5FAB61E3DB6B54B51FBA607865C195B
SHA1:	B94D9126E8FC9D5F29FAFBB67F068E2D111D17FC
SHA-256:	0CB9F9A451A1E365AC54B4C88662E1DA0CB54A72D16A5258FB0ABFF9D3E1C022
SHA-512:	ABD3EF61D8D578C1DE609560A6985503E60BD53F90DCFF54EBEE23714D9CD88DBA4036ED19B24EC62B8432550311894FCC47BDCCD7CE4DCDE82518F4E02E123C
Malicious:	false
Preview:	tomli-2.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..tomli-2.0.1.dist-info/LICENSE,sha256=uAgWsNUwuKzLTCIReDeQmEpuO2GSLCte6S8zcqsnQv4,1072..tomli-2.0.1.dist-info/METADATA,sha256=zPDceKmPwJGLWtZykrHixL7WVXWmJGzZ1jyRT5lCoPI,8875..tomli-2.0.1.dist-info/RECORD,,..tomli-2.0.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..tomli-2.0.1.dist-info/WHEEL,sha256=jPMR_Dzkc4X4icQtmz81lnNY_kAsfog7ry7qoRvYLXw,81..tomli/__init__.py,sha256=JhUwV66DB1g4Hvt1UQCVMdfCu-IgAV8FXmvDU9onxd4,396..tomli/__pycache__/__init__.cpython-312.pyc,,..tomli/__pycache__/_parser.cpython-312.pyc,,..tomli/__pycache__/_re.cpython-312.pyc,,..tomli/__pycache__/_types.cpython-312.pyc,,..tomli/_parser.py,sha256=g9-ENaALS-B8dokYpCuzUFalWlog7T-SIYMjLZSWrtM,22633..tomli/_re.py,sha256=dbjg5ChZT23Ka9z9DHOXfdtSpPwUfdgMXnj8NOoly-w,2943..tomli/_types.py,sha256=-GTG2VUqkpxwMqzmVO4F7ybKddIbAnuAHXfmWQcTi3Q,254..tomli/py.typed,sha256=8PjyZ1aVoQpRVvt71muvuq5qE-jTFZkK-GLHkhdebmc,26..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\tomli-2.0.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFMthP+tPCCfA5I:Rt1QqDWBB3
MD5:	FF39892A240316BD62B5832C03D504BC
SHA1:	3883FC4406CC9A73BE0B839C1A0C31D3DDD64829
SHA-256:	8CF311FC3CE47385F889C42D9B3F35967358FE402C7E883BAF2EEAA11BD82D7C
SHA-512:	B2E57D9C81BBFB7364B8216FC086B8F73C2F2B537E300FB250EFB7972E3908F77A3D504363676C50A195D307822C69EE9B689DE6C48A4E6B8A6BA89A5A99AC32
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.6.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typeguard-4.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typeguard-4.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	5.118590213496374
Encrypted:	false
SSDEEP:	24:qt4rWHvH0yPP3Gt6Hw1hP9QHmsUv48OV/+dho3BoqxFB:/S/lPvKhlQHms5QK3WmFB
MD5:	F0E423EEA5C91E7AA21BDB70184B3E53
SHA1:	A51CCDCB7A9D8C2116D1DFC16F11B3C8A5830F67
SHA-256:	6163F7987DFB38D6BC320CE2B70B2F02B862BC41126516D552EF1CD43247E758
SHA-512:	8BE742880E6E8495C7EC4C9ECC8F076A9FC9D64FC84B3AEBBC8D2D10DC62AC2C5053F33B716212DCB76C886A9C51619F262C460FC4B39A335CE1AE2C9A8769A8
Malicious:	false
Preview:	This is the MIT license: http://www.opensource.org/licenses/mit-license.php..Copyright (c) Alex Gr.nholm..Permission is hereby granted, free of charge, to any person obtaining a copy of this.software and associated documentation files (the "Software"), to deal in the Software.without restriction, including without limitation the rights to use, copy, modify, merge,.publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons.to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or.substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,.INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR.PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE.FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF C

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typeguard-4.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3717
Entropy (8bit):	4.986068381037722
Encrypted:	false
SSDEEP:	96:DSQRbraktjaAckH94jQnJIK04Fak/grjspC3EklAJj:/Rakd4jA7ak/gvspNWmj
MD5:	B6DAAC02F66AC8403E9061881322BABE
SHA1:	9A94672CCFEA06156A5F8A321CD0626CFD233AE8
SHA-256:	CF675C1C0A744F08580855390DE87CC77D676B312582E8D4CFDB5BB8FD298D21
SHA-512:	9C6B7326C90396AA9E962C2731A1085EDB672B5696F95F552D13350843C09A246E0BBF0EC484862DFF434FA5A86DE4C0B7C963958ADE35A066B9D2384076DD47
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: typeguard.Version: 4.3.0.Summary: Run-time type checker for Python.Author-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.License: MIT.Project-URL: Documentation, https://typeguard.readthedocs.io/en/latest/.Project-URL: Change log, https://typeguard.readthedocs.io/en/latest/versionhistory.html.Project-URL: Source code, https://github.com/agronholm/typeguard.Project-URL: Issue tracker, https://github.com/agronholm/typeguard/issues.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Python: >=3.8.Description-Content

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typeguard-4.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	5.729208478282605
Encrypted:	false
SSDEEP:	48:eDnuX3DVED9HDDeDfPDLkAosGDlDiVoBFj7XH0H3HuwVB6Kgfkx7J/Q1NK1cQyxk:eyX3WRHDiLPjksV7I47J/Q1U6Qyx5fsJ
MD5:	D680B2881597974ACD91750E5AB61010
SHA1:	E00ED2416B5CE21641E3946905504D62D536972F
SHA-256:	48A51959582478352275428CEECD78EF77D79AC9DAE796E39A2EAF2540282552
SHA-512:	112172ACB515B0712AC58D78898EB159580ADA3DD3F16AABB37CB7A8D964F9E4BADF2869A245927B83B208D56904831C0F04ED925C95DFCB705801734FB0C7BA
Malicious:	false
Preview:	typeguard-4.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typeguard-4.3.0.dist-info/LICENSE,sha256=YWP3mH37ONa8MgzitwsvArhivEESZRbVUu8c1DJH51g,1130..typeguard-4.3.0.dist-info/METADATA,sha256=z2dcHAp0TwhYCFU5Deh8x31nazElgujUz9tbuP0pjSE,3717..typeguard-4.3.0.dist-info/RECORD,,..typeguard-4.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..typeguard-4.3.0.dist-info/entry_points.txt,sha256=qp7NQ1aLtiSgMQqo6gWlfGpy0IIXzoMJmeQTLpzqFZQ,48..typeguard-4.3.0.dist-info/top_level.txt,sha256=4z28AhuDodwRS_c1J_l8H51t5QuwfTseskYzlxp6grs,10..typeguard/__init__.py,sha256=Onh4w38elPCjtlcU3JY9k3h70NjsxXIkAflmQn-Z0FY,2071..typeguard/__pycache__/__init__.cpython-312.pyc,,..typeguard/__pycache__/_checkers.cpython-312.pyc,,..typeguard/__pycache__/_config.cpython-312.pyc,,..typeguard/__pycache__/_decorators.cpython-312.pyc,,..typeguard/__pycache__/_exceptions.cpython-312.pyc,,..typeguard/__pycache__/_functions.cpython-312.pyc,,..typeguard/__pycache__/_i

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typeguard-4.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typeguard-4.3.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.155187698990101
Encrypted:	false
SSDEEP:	3:mWSJCQEjMitjHfLvn:mrMJHfbn
MD5:	AEAB5BCF8BF89A51C97C4CDF70578848
SHA1:	2E9C1617560AB66431AAB90700DB901985293485
SHA-256:	AA9ECD43568BB624A0310AA8EA05A57C6A72D08217CE830999E4132E9CEA1594
SHA-512:	2BE73E99296DF26A28835F91DD8BC50EB104AF06A3C54666175FAF322E0AD4620453DB0388531C4113B052A92C1D2E4C3088E25AF43CDE42AA852CF7B0CB5B05
Malicious:	false
Preview:	[pytest11].typeguard = typeguard._pytest_plugin.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typeguard-4.3.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:LEJn:M
MD5:	004A2A8CE1AB120A63902A27D76BD964
SHA1:	A4E367AB40410598DADD1FC5F680ED7A176BEB09
SHA-256:	E33DBC021B83A1DC114BF73527F97C1F9D6DE50BB07D3B1EB24633971A7A82BB
SHA-512:	0D8FF9A43897AB390AB41AFE5BAC8BD38A68C2BEF88E844E5B49BF70E3164B226975CC2717AE3DC3428D1CFBB0BE068C243F104915FEE1FFA58C23FBE76FDB89
Malicious:	false
Preview:	typeguard.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typing_extensions-4.12.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typing_extensions-4.12.2.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13936
Entropy (8bit):	5.135214154002924
Encrypted:	false
SSDEEP:	384:cke8RQ6KSAdxC9ad9iqsibQtKti9zpQpzu9Jkh:K8RQ6q7C9ad9iqT8cti9zpQpzu7kh
MD5:	FCF6B249C2641540219A727F35D8D2C2
SHA1:	C6E195F9AA30CC9B675D1612CA4FB7F74111BD35
SHA-256:	3B2F81FE21D181C499C59A256C8E1968455D6689D269AA85373BFB6AF41DA3BF
SHA-512:	70367B908204B5922E5D9D2ACE39437DBAA1EEFDAD1797B50CC6E7DCA168D9B59199353BADDDCAEEE12B49D328FC8132F628952383CFE6803CB4F4BF9B9D6D86
Malicious:	false
Preview:	A. HISTORY OF THE SOFTWARE.==========================..Python was created in the early 1990s by Guido van Rossum at Stichting.Mathematisch Centrum (CWI, see https://www.cwi.nl) in the Netherlands.as a successor of a language called ABC. Guido remains Python's.principal author, although it includes many contributions from others...In 1995, Guido continued his work on Python at the Corporation for.National Research Initiatives (CNRI, see https://www.cnri.reston.va.us).in Reston, Virginia where he released several versions of the.software...In May 2000, Guido and the Python core development team moved to.BeOpen.com to form the BeOpen PythonLabs team. In October of the same.year, the PythonLabs team moved to Digital Creations, which became.Zope Corporation. In 2001, the Python Software Foundation (PSF, see.https://www.python.org/psf/) was formed, a non-profit organization.created specifically to own Python-related Intellectual Property..Zope Corporation was a sponsoring member of the PS

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typing_extensions-4.12.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	5.0579916471633
Encrypted:	false
SSDEEP:	48:DtkCMU2ymXbFX1QI/aMktjaVQEBu+FOK+W6i+qXd0qme28mIp9DvvV+Vz+nlh:DtkCD/mxX1QI/aMktjaVBroBBqd0VODD
MD5:	8303191AC93E4D32457A4A9E3CDAD8E5
SHA1:	B6ADA54B9516D20B69A5DD5CDED868DA22C5E252
SHA-256:	05E51021AF1C9D86EB8D6C7E37C4CECE733D5065B91A6D8389C5690ED440F16D
SHA-512:	F2F5DBE5EA55ED720FA4191180076E9EFFCB9C811C3C7BF1A1201E9D78590B381E125EAF7B8366B28A03383C2958449423548576605E8DCB5CC11C33C9B0E709
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: typing_extensions.Version: 4.12.2.Summary: Backported and Experimental Type Hints for Python 3.8+.Keywords: annotations,backport,checker,checking,function,hinting,hints,type,typechecking,typehinting,typehints,typing.Author-email: "Guido van Rossum, Jukka Lehtosalo, .ukasz Langa, Michael Lee" <levkivskyi@gmail.com>.Requires-Python: >=3.8.Description-Content-Type: text/markdown.Classifier: Development Status :: 5 - Production/Stable.Classifier: Environment :: Console.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Python Software Foundation License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Langua

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typing_extensions-4.12.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	571
Entropy (8bit):	5.751670348693122
Encrypted:	false
SSDEEP:	12:rCA89x0a/2zDuxv/vjWaxLbSaLjxjxXaefIE12BATqyo/C:mA87n/2zD6vXCulVZf5Cc4C
MD5:	B884E8832BFB336C2D7F54271F11EE1C
SHA1:	5A3BAABEE79E0CF32D2E87C9AF0FBB3AAD8CACAD
SHA-256:	7710002D81971E632AA6A2FC33DC5D74AAF5D7CAAE22040A65D3E31503B05EE9
SHA-512:	0A5EB3ABED212C474CB5FDDEF47F8E62DAA130128F2BB368A8E1F12E143DAE2F8B2EF4A9B85A883A03C67195829AD637DB7CF7CC4B41535AF6CA5668F8F2BD0B
Malicious:	false
Preview:	__pycache__/typing_extensions.cpython-312.pyc,,..typing_extensions-4.12.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typing_extensions-4.12.2.dist-info/LICENSE,sha256=Oy-B_iHRgcSZxZolbI4ZaEVdZonSaaqFNzv7avQdo78,13936..typing_extensions-4.12.2.dist-info/METADATA,sha256=BeUQIa8cnYbrjWx-N8TOznM9UGW5Gm2DicVpDtRA8W0,3018..typing_extensions-4.12.2.dist-info/RECORD,,..typing_extensions-4.12.2.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..typing_extensions.py,sha256=gwekpyG9DVG3lxWKX4ni8u7nk3We5slG98mA9F3DJQw,134451..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\typing_extensions-4.12.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\zipp-3.19.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\zipp-3.19.2.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.059832621894572
Encrypted:	false
SSDEEP:	24:OrmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:OaJ8YHvEH5QHOs5exm3oEFJ
MD5:	141643E11C48898150DAA83802DBC65F
SHA1:	0445ED0F69910EEAEE036F09A39A13C6E1F37E12
SHA-256:	86DA0F01AEAE46348A3C3D465195DC1CECCDE79F79E87769A64B8DA04B2A4741
SHA-512:	EF62311602B466397BAF0B23CACA66114F8838F9E78E1B067787CEB709D09E0530E85A47BBCD4C5A0905B74FDB30DF0CC640910C6CC2E67886E5B18794A3583F
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\zipp-3.19.2.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3575
Entropy (8bit):	5.085545958857746
Encrypted:	false
SSDEEP:	96:D0h4aC/S802Vpnu3pyt1Q+/+DeVb0ksYSwTgD:Oc/z02Vpnu3pytS+2DeVNfSwTW
MD5:	F659E7F578CE6FD3753871DBBBA1F939
SHA1:	C53B0E6A2E3D94093E2FE4978926A7439B47D43C
SHA-256:	508AE4FE43081C64B0B0A2828588B3A8CC3430C6693D1676662569400B0DFDB1
SHA-512:	2C0496B76D259259A8F1E57F3ED2224A7E3E99FF309F764C00A8377BB5BD1C94035BDDF24BD1BA637209677CB9F4E8109F84C50B3488B5B8FC372B6BEDAB9AE0
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: zipp.Version: 3.19.2.Summary: Backport of pathlib-compatible object wrapper for zip files.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Homepage, https://github.com/jaraco/zipp.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: test.Requires-Dist: pytest !=8.1.*,>=6 ; extra == 'test'.Requires-Dist: pytest-checkdocs >=2.4 ; extra == 'test'.Requir

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\zipp-3.19.2.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.8094923667268965
Encrypted:	false
SSDEEP:	24:An/2zDlvbqfuiwbWk/EsJ6Xam9lpW8OWq3tW36nJA3u3iWwksYW:AnuXlzUuitk/5J6f9lpW8OW4tM6nJSkE
MD5:	1E77310EF3277C93430D969FEAC8FDFC
SHA1:	173240337F249E2A6D54206AA0D0ACB0FDED12D7
SHA-256:	F316F2E03FD9ADE7EBBC0B154706848E2BB8FD568B90935109F0D8E3CE2B9BFE
SHA-512:	68F752DAF2DBEB79644337E4DB9B8CEAEAE3606A865EDC32BE16785DC97BDCF38EF200F0EDC86DC9D71ABA72E108D2851A510F0EB598FFEA286503F0C9772E5E
Malicious:	false
Preview:	zipp-3.19.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..zipp-3.19.2.dist-info/LICENSE,sha256=htoPAa6uRjSKPD1GUZXcHOzN55956HdppkuNoEsqR0E,1023..zipp-3.19.2.dist-info/METADATA,sha256=UIrk_kMIHGSwsKKChYizqMw0MMZpPRZ2ZiVpQAsN_bE,3575..zipp-3.19.2.dist-info/RECORD,,..zipp-3.19.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..zipp-3.19.2.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..zipp-3.19.2.dist-info/top_level.txt,sha256=iAbdoSHfaGqBfVb2XuR9JqSQHCoOsOtG6y9C_LSpqFw,5..zipp/__init__.py,sha256=QuI1g00G4fRAcGt-HqbV0oWIkmSgedCGGYsHHYzNa8A,13412..zipp/__pycache__/__init__.cpython-312.pyc,,..zipp/__pycache__/glob.cpython-312.pyc,,..zipp/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..zipp/compat/__pycache__/__init__.cpython-312.pyc,,..zipp/compat/__pycache__/py310.cpython-312.pyc,,..zipp/compat/py310.py,sha256=eZpkW0zRtunkhEh8jjX3gCGe22emoKCBJw72Zt4RkhA,219..zipp/glob.py,sha256=etWpnfEoRyf

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\zipp-3.19.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\setuptools\_vendor\zipp-3.19.2.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:m:m
MD5:	9B929466EC7848714DE24BCF75AE57CB
SHA1:	ECC9237295CDA9B690BE094E58FAE1458A4B0389
SHA-256:	8806DDA121DF686A817D56F65EE47D26A4901C2A0EB0EB46EB2F42FCB4A9A85C
SHA-512:	C8D8967BE2B5094A5D72BA4BEF5DBDA2CBF539BF3B8B916CF86854087A12DF82B51B7BF5B6EFA79898692EFD22FAD9688058448CAAB198FB708A0E661DC685EA
Malicious:	false
Preview:	zipp.

C:\Users\user\AppData\Local\Temp\_MEI13962\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1541912
Entropy (8bit):	6.576600643401234
Encrypted:	false
SSDEEP:	24576:8U/QhAI889YyuQYZlm/8AgzMkf6G5MJ8NW/yKhh+ivz/LZ/Xm+5D3ovTCJ7:NVyuQYZlm/8vP6G5MJ8NuF+IzDZ/XPoI
MD5:	956EF70F60FB099D31A79FA7334359AD
SHA1:	336A78492C0E10FAB4BAA0ADD7552E52F61DD110
SHA-256:	809C7B48B73C95B361D13C753E7A6E3C83124A27E18AAC81DF7C876F32E98E00
SHA-512:	7FD74B92E32A385B193264D0F08A390EEC672E508EF85BF0439BDB713A9C8909688F845BCACD4ADB3DD91B08A3EB40AE32532A08FC9378ED4530646FB871FD50
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tB..,...,...,..m....,.D.-...,.D./...,.D.(...,.D.)...,..m-...,...-...,...$...,...,...,......,.......,.Rich..,.........PE..d......f.........." ...(.2...,.......1....................................................`..............................................#...&.......p...............X.../......X...0...T..............................@............P..X............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data...`M...@...D..................@....pdata...............`..............@..@.rsrc........p.......>..............@..@.reloc..X............H..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	5.118590213496374
Encrypted:	false
SSDEEP:	24:qt4rWHvH0yPP3Gt6Hw1hP9QHmsUv48OV/+dho3BoqxFB:/S/lPvKhlQHms5QK3WmFB
MD5:	F0E423EEA5C91E7AA21BDB70184B3E53
SHA1:	A51CCDCB7A9D8C2116D1DFC16F11B3C8A5830F67
SHA-256:	6163F7987DFB38D6BC320CE2B70B2F02B862BC41126516D552EF1CD43247E758
SHA-512:	8BE742880E6E8495C7EC4C9ECC8F076A9FC9D64FC84B3AEBBC8D2D10DC62AC2C5053F33B716212DCB76C886A9C51619F262C460FC4B39A335CE1AE2C9A8769A8
Malicious:	false
Preview:	This is the MIT license: http://www.opensource.org/licenses/mit-license.php..Copyright (c) Alex Gr.nholm..Permission is hereby granted, free of charge, to any person obtaining a copy of this.software and associated documentation files (the "Software"), to deal in the Software.without restriction, including without limitation the rights to use, copy, modify, merge,.publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons.to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or.substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,.INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR.PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE.FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF C

C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3717
Entropy (8bit):	4.986068381037722
Encrypted:	false
SSDEEP:	96:DSQRbraktjaAckH94jQnJIK04Fak/grjspC3EklAJj:/Rakd4jA7ak/gvspNWmj
MD5:	B6DAAC02F66AC8403E9061881322BABE
SHA1:	9A94672CCFEA06156A5F8A321CD0626CFD233AE8
SHA-256:	CF675C1C0A744F08580855390DE87CC77D676B312582E8D4CFDB5BB8FD298D21
SHA-512:	9C6B7326C90396AA9E962C2731A1085EDB672B5696F95F552D13350843C09A246E0BBF0EC484862DFF434FA5A86DE4C0B7C963958ADE35A066B9D2384076DD47
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: typeguard.Version: 4.3.0.Summary: Run-time type checker for Python.Author-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.License: MIT.Project-URL: Documentation, https://typeguard.readthedocs.io/en/latest/.Project-URL: Change log, https://typeguard.readthedocs.io/en/latest/versionhistory.html.Project-URL: Source code, https://github.com/agronholm/typeguard.Project-URL: Issue tracker, https://github.com/agronholm/typeguard/issues.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Python: >=3.8.Description-Content

C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	5.729208478282605
Encrypted:	false
SSDEEP:	48:eDnuX3DVED9HDDeDfPDLkAosGDlDiVoBFj7XH0H3HuwVB6Kgfkx7J/Q1NK1cQyxk:eyX3WRHDiLPjksV7I47J/Q1U6Qyx5fsJ
MD5:	D680B2881597974ACD91750E5AB61010
SHA1:	E00ED2416B5CE21641E3946905504D62D536972F
SHA-256:	48A51959582478352275428CEECD78EF77D79AC9DAE796E39A2EAF2540282552
SHA-512:	112172ACB515B0712AC58D78898EB159580ADA3DD3F16AABB37CB7A8D964F9E4BADF2869A245927B83B208D56904831C0F04ED925C95DFCB705801734FB0C7BA
Malicious:	false
Preview:	typeguard-4.3.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..typeguard-4.3.0.dist-info/LICENSE,sha256=YWP3mH37ONa8MgzitwsvArhivEESZRbVUu8c1DJH51g,1130..typeguard-4.3.0.dist-info/METADATA,sha256=z2dcHAp0TwhYCFU5Deh8x31nazElgujUz9tbuP0pjSE,3717..typeguard-4.3.0.dist-info/RECORD,,..typeguard-4.3.0.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92..typeguard-4.3.0.dist-info/entry_points.txt,sha256=qp7NQ1aLtiSgMQqo6gWlfGpy0IIXzoMJmeQTLpzqFZQ,48..typeguard-4.3.0.dist-info/top_level.txt,sha256=4z28AhuDodwRS_c1J_l8H51t5QuwfTseskYzlxp6grs,10..typeguard/__init__.py,sha256=Onh4w38elPCjtlcU3JY9k3h70NjsxXIkAflmQn-Z0FY,2071..typeguard/__pycache__/__init__.cpython-312.pyc,,..typeguard/__pycache__/_checkers.cpython-312.pyc,,..typeguard/__pycache__/_config.cpython-312.pyc,,..typeguard/__pycache__/_decorators.cpython-312.pyc,,..typeguard/__pycache__/_exceptions.cpython-312.pyc,,..typeguard/__pycache__/_functions.cpython-312.pyc,,..typeguard/__pycache__/_i

C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlFxP+tPCCfA5S:RtBMwlVTxWBBf
MD5:	43136DDE7DD276932F6197BB6D676EF4
SHA1:	6B13C105452C519EA0B65AC1A975BD5E19C50122
SHA-256:	189EEDFE4581172C1B6A02B97A8F48A14C0B5BAA3239E4CA990FBD8871553714
SHA-512:	E7712BA7D36DEB083EBCC3B641AD3E7D19FB071EE64AE3A35AD6A50EE882B20CD2E60CA1319199DF12584FE311A6266EC74F96A3FB67E59F90C7B5909668AEE1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.43.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.155187698990101
Encrypted:	false
SSDEEP:	3:mWSJCQEjMitjHfLvn:mrMJHfbn
MD5:	AEAB5BCF8BF89A51C97C4CDF70578848
SHA1:	2E9C1617560AB66431AAB90700DB901985293485
SHA-256:	AA9ECD43568BB624A0310AA8EA05A57C6A72D08217CE830999E4132E9CEA1594
SHA-512:	2BE73E99296DF26A28835F91DD8BC50EB104AF06A3C54666175FAF322E0AD4620453DB0388531C4113B052A92C1D2E4C3088E25AF43CDE42AA852CF7B0CB5B05
Malicious:	false
Preview:	[pytest11].typeguard = typeguard._pytest_plugin.

C:\Users\user\AppData\Local\Temp\_MEI13962\typeguard-4.3.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:LEJn:M
MD5:	004A2A8CE1AB120A63902A27D76BD964
SHA1:	A4E367AB40410598DADD1FC5F680ED7A176BEB09
SHA-256:	E33DBC021B83A1DC114BF73527F97C1F9D6DE50BB07D3B1EB24633971A7A82BB
SHA-512:	0D8FF9A43897AB390AB41AFE5BAC8BD38A68C2BEF88E844E5B49BF70E3164B226975CC2717AE3DC3428D1CFBB0BE068C243F104915FEE1FFA58C23FBE76FDB89
Malicious:	false
Preview:	typeguard.

C:\Users\user\AppData\Local\Temp\_MEI13962\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1016584
Entropy (8bit):	6.669319438805479
Encrypted:	false
SSDEEP:	24576:VkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkA:mmZFHhp9v1Io3h0TN3pvkA
MD5:	0E0BAC3D1DCC1833EAE4E3E4CF83C4EF
SHA1:	4189F4459C54E69C6D3155A82524BDA7549A75A6
SHA-256:	8A91052EF261B5FBF3223AE9CE789AF73DFE1E9B0BA5BDBC4D564870A24F2BAE
SHA-512:	A45946E3971816F66DD7EA3788AACC384A9E95011500B458212DC104741315B85659E0D56A41570731D338BDF182141C093D3CED222C007038583CEB808E26FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..l9F.l9F.l9F...F.l9F.l8F.l9F...F.l9F..9G.l9F..:G.l9F..<G.l9F..7G.n9F..=G.l9F...F.l9F..;G.l9FRich.l9F........PE..d.....}X.........." .........`............................................................`A................................................p......................F...=......p...PX..T............................'...............O...............................text............................... ..`.rdata..<u.......v..................@..@.data....$...........r..............@....pdata.............................@..@.rsrc................4..............@..@.reloc..p............:..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1138456
Entropy (8bit):	5.461877321211646
Encrypted:	false
SSDEEP:	12288:FrEHdcM6hb/CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAa1:FrEXaCjfk7bPNfv42BN6yzUAa1
MD5:	B848E259FABAF32B4B3C980A0A12488D
SHA1:	DA2E864E18521C86C7D8968DB74BB2B28E4C23E2
SHA-256:	C65073B65F107E471C9BE3C699FB11F774E9A07581F41229582F7B2154B6FC3C
SHA-512:	4C6953504D1401FE0C74435BCEEBC5EC7BF8991FD42B659867A3529CEE5CC64DA54F1AB404E88160E747887A7409098F1A85A546BC40F12F0DDE0025408F9E27
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...%.}..\|.!.}..~. .}..y.+.}..x...}.6-\|. .}.h.\|.!.}.#.\|.s.}.6-p.".}.6-}.".}.6-..".}.6-..".}.Rich#.}.........PE..d....f.........." ...(.@..........0.......................................p......]M....`.........................................p...X............P.......@.......0.../...`......P^..T............................]..@............P..p............................text...!>.......@.................. ..`.rdata..\....P.......D..............@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI13962\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\FluxusV2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.996512866879367
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	FluxusV2.exe
File size:	17'331'825 bytes
MD5:	712e80900b6235d74f0c82edfa0cb165
SHA1:	ac466cbf763fb3a3aabbea754546bcb86c765311
SHA256:	7a515b7c74af74acd14cd715c60565a6b6b11026f07fb2a64f324b9ce89090d5
SHA512:	af596ea6b5d6ad43f26b2cc9c475aa56e9d50690798a8228e982aa706ceeedeec752a3badfcb54142ef6544460f116cbda775cd32839525e94629619e67fe90c
SSDEEP:	393216:LEkFtGV2JntpUTLfhJe1+TtIiF/ZxSbDNsIfeISDY06a3tw:Ld0cHUTLJE1QtI6YbiImBJ6a3
TLSH:	E507334DE2E109AAF6C66039D7A282752BD238A46B91D39F07FC12351FB31D15D3E782
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Zpc.Zpc.Zpc...`.]pc...f..pc...g.Ppc.....Ypc...`.Spc...g.Kpc...f.rpc...b.Qpc.Zpb..pc.O.g.Cpc.O.a.[pc.RichZpc.........PE..d..

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F7A235 [Sat Sep 28 06:29:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD6887B3CDCh
dec eax
add esp, 28h
jmp 00007FD6887B38FFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FD6887B40A8h
test eax, eax
je 00007FD6887B3AA3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FD6887B3A87h
dec eax
cmp ecx, eax
je 00007FD6887B3A96h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007FD6887B3A70h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FD6887B3A79h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FD6887B3A89h
mov byte ptr [00035765h], 00000001h
call 00007FD6887B31D5h
call 00007FD6887B44C0h
test al, al
jne 00007FD6887B3A86h
xor al, al
jmp 00007FD6887B3A96h
call 00007FD6887C0FDFh
test al, al
jne 00007FD6887B3A8Bh
xor ecx, ecx
call 00007FD6887B44D0h
jmp 00007FD6887B3A6Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007FD6887B3AE9h
cmp ecx, 01h
jnbe 00007FD6887B3AECh
call 00007FD6887B401Eh
test eax, eax
je 00007FD6887B3AAAh
test ebx, ebx
jne 00007FD6887B3AA6h
dec eax
lea ecx, dword ptr [00035716h]
call 00007FD6887C0DD2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	a6c3b829cc8eaabb1a474c227e90407f	False	0.5514206659226191	data	6.487493643901088	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	58b4a20c50be009f205b9048c03d7ec5	False	0.52453125	data	5.752838418196028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	181312260a85d10a1454ba38901c499b	False	0.4705946180555556	data	5.290347578351011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0xf41c	0xf600	455788c285fcfdcb4008bc77e762818a	False	0.803099593495935	data	7.5549760623589695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x480b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x48958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x48ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x523ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x54994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x55a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x55ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x55f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 01:30:15.836179018 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 13, 2024 01:30:15.836257935 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 13, 2024 01:30:15.836371899 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 13, 2024 01:30:17.804953098 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 13, 2024 01:30:17.805037975 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 13, 2024 01:30:18.333861113 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 13, 2024 01:30:18.334875107 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 13, 2024 01:30:18.334906101 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 13, 2024 01:30:18.336669922 CEST	443	49734	104.26.3.16	192.168.2.6
Oct 13, 2024 01:30:18.336747885 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 13, 2024 01:30:18.338172913 CEST	49734	443	192.168.2.6	104.26.3.16
Oct 13, 2024 01:30:18.338331938 CEST	49734	443	192.168.2.6	104.26.3.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 01:30:15.825064898 CEST	59647	53	192.168.2.6	1.1.1.1
Oct 13, 2024 01:30:15.832983017 CEST	53	59647	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 01:30:15.825064898 CEST	192.168.2.6	1.1.1.1	0x49db	Standard query (0)	rentry.co	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 01:30:15.832983017 CEST	1.1.1.1	192.168.2.6	0x49db	No error (0)	rentry.co	104.26.3.16	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:30:15.832983017 CEST	1.1.1.1	192.168.2.6	0x49db	No error (0)	rentry.co	104.26.2.16	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:30:15.832983017 CEST	1.1.1.1	192.168.2.6	0x49db	No error (0)	rentry.co	172.67.75.40	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	19:30:06
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\FluxusV2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\FluxusV2.exe"
Imagebase:	0x7ff6eb1e0000
File size:	17'331'825 bytes
MD5 hash:	712E80900B6235D74F0C82EDFA0CB165
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	19:30:11
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\FluxusV2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\FluxusV2.exe"
Imagebase:	0x7ff6eb1e0000
File size:	17'331'825 bytes
MD5 hash:	712E80900B6235D74F0C82EDFA0CB165
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CStealer, Description: Yara detected CStealer, Source: 00000002.00000002.3453819663.0000016AAECA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	34

Executed Functions

Function 00007FF6EB1E89E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6EB1E9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6EB1E45F4,00000000,00007FF6EB1E1985), ref: 00007FF6EB1E93C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8A56

Part of subcall function 00007FF6EB1FA47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1FA490

Part of subcall function 00007FF6EB1F871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F8783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8AE6
CreateProcessW.KERNELBASE ref: 00007FF6EB1E8B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8B28

Part of subcall function 00007FF6EB1E2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EB1E3706,?,00007FF6EB1E3804), ref: 00007FF6EB1E2C9E
Part of subcall function 00007FF6EB1E2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EB1E3706,?,00007FF6EB1E3804), ref: 00007FF6EB1E2D63
Part of subcall function 00007FF6EB1E2C50: MessageBoxW.USER32 ref: 00007FF6EB1E2D99

RegisterClassW.USER32 ref: 00007FF6EB1E8B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8B8B
CreateWindowExW.USER32 ref: 00007FF6EB1E8BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8C15
PeekMessageW.USER32 ref: 00007FF6EB1E8C39
TranslateMessage.USER32 ref: 00007FF6EB1E8C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8C51
PeekMessageW.USER32 ref: 00007FF6EB1E8C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8E04
GetExitCodeProcess.KERNEL32 ref: 00007FF6EB1E8E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6EB1E3F77), ref: 00007FF6EB1E8E2F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF6EB1E8B54
PyInstaller Onefile Hidden Window, xrefs: 00007FF6EB1E8B95
Failed to create child process!, xrefs: 00007FF6EB1E8B30
CreateProcessW, xrefs: 00007FF6EB1E8B37

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 3c995c12de003b98a38b27ee9bd71d5a111c5962db11d1bf70e232084fa9325a
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 43D14F33A08A8286EB209F34E8643BD6764FF88768F500235DA5D93AB4DF3ED545C746

Function 00007FF6EB1E1000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6EB1E3D12
pyi-contents-directory, xrefs: 00007FF6EB1E3B8D
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6EB1E3B32
Failed to convert DLL search path!, xrefs: 00007FF6EB1E3DD4
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6EB1E3D35
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6EB1E3EB3
_PYI_SPLASH_IPC, xrefs: 00007FF6EB1E3A23, 00007FF6EB1E3EED
Failed to start splash screen!, xrefs: 00007FF6EB1E3ECC
_PYI_ARCHIVE_FILE, xrefs: 00007FF6EB1E38D2, 00007FF6EB1E39FF
pyi-disable-windowed-traceback, xrefs: 00007FF6EB1E3BB2
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6EB1E3882, 00007FF6EB1E38AF
VCRUNTIME140.dll, xrefs: 00007FF6EB1E3DA9
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6EB1E3971
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6EB1E3A17, 00007FF6EB1E3A2F, 00007FF6EB1E3A9B
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6EB1E3E02
pyi-runtime-tmpdir, xrefs: 00007FF6EB1E3B68
Failed to load splash screen resources!, xrefs: 00007FF6EB1E3E7D
pyi-python-flag, xrefs: 00007FF6EB1E3AD6
pkg, xrefs: 00007FF6EB1E39BE
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6EB1E3E9E
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6EB1E3A0B, 00007FF6EB1E3CD4, 00007FF6EB1E3F63
MEI, xrefs: 00007FF6EB1E3933
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6EB1E3C61
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6EB1E3BE8
Py_GIL_DISABLED, xrefs: 00007FF6EB1E3AF4
Could not create temporary directory!, xrefs: 00007FF6EB1E3CBF
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6EB1E39DE
Failed to remove temporary directory: %s, xrefs: 00007FF6EB1E3FC7

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 27943e01e1a6207795b46aedf17b893e8f8e32d3898c7290fa00b00b011f2019
Instruction ID: 52655b5aee18f4673c4f84956a500d28b35f3728e4250cc62bd74e59050f982b
Opcode Fuzzy Hash: 27943e01e1a6207795b46aedf17b893e8f8e32d3898c7290fa00b00b011f2019
Instruction Fuzzy Hash: 33328223E0C68255FB16D725A6643FD6251AF4C7A8F844032DA4DC3AF6EF2EE554C30A

Function 00007FF6EB205C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6EB205C45

Part of subcall function 00007FF6EB205598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2055AC

Part of subcall function 00007FF6EB1FA948: RtlFreeHeap.NTDLL(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA95E
Part of subcall function 00007FF6EB1FA948: GetLastError.KERNEL32(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA968

Part of subcall function 00007FF6EB1FA900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6EB1FA8DF,?,?,?,?,?,00007FF6EB1FA7CA), ref: 00007FF6EB1FA909
Part of subcall function 00007FF6EB1FA900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6EB1FA8DF,?,?,?,?,?,00007FF6EB1FA7CA), ref: 00007FF6EB1FA92E

_get_daylight.LIBCMT ref: 00007FF6EB205C34

Part of subcall function 00007FF6EB2055F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB20560C

_get_daylight.LIBCMT ref: 00007FF6EB205EAA
_get_daylight.LIBCMT ref: 00007FF6EB205EBB
_get_daylight.LIBCMT ref: 00007FF6EB205ECC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6EB20610C), ref: 00007FF6EB205EF3

Strings

Eastern Summer Time, xrefs: 00007FF6EB205FB1
Eastern Standard Time, xrefs: 00007FF6EB205F99

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: 1017775de043f2d3c46aba312a8ab0018fc9ff29771313304c87bc7df8bf7b68
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: F0D1D527A182424EE7209F31DAA03B96761FF8C794F448135EA4DC76A5EF3EE441C74A

Function 00007FF6EB206964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6EB206698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2066D9
Part of subcall function 00007FF6EB206698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB206757
Part of subcall function 00007FF6EB206698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2067A8

CreateFileW.KERNELBASE ref: 00007FF6EB206A6A
CreateFileW.KERNEL32 ref: 00007FF6EB206ABA
GetLastError.KERNEL32 ref: 00007FF6EB206AEA
GetFileType.KERNELBASE ref: 00007FF6EB206AFF
GetLastError.KERNEL32 ref: 00007FF6EB206B09
CloseHandle.KERNEL32 ref: 00007FF6EB206B3C
CloseHandle.KERNEL32 ref: 00007FF6EB206C9F
CreateFileW.KERNEL32 ref: 00007FF6EB206CD4
GetLastError.KERNEL32 ref: 00007FF6EB206CE3

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 1d18905feefc2876fd96d53137f2cd7e307ec7eaf88f656df72c6858235c65da
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 61C1BF33B28A4589EB11CFA9C5A03BC3761EB4DBA8F114235DA1E9B7A4DF3AD051D305

Function 00007FF6EB205E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6EB205EAA

Part of subcall function 00007FF6EB2055F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB20560C

_get_daylight.LIBCMT ref: 00007FF6EB205EBB

Part of subcall function 00007FF6EB205598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2055AC

_get_daylight.LIBCMT ref: 00007FF6EB205ECC

Part of subcall function 00007FF6EB2055C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2055DC

Part of subcall function 00007FF6EB1FA948: RtlFreeHeap.NTDLL(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA95E
Part of subcall function 00007FF6EB1FA948: GetLastError.KERNEL32(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA968

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6EB20610C), ref: 00007FF6EB205EF3

Strings

Eastern Summer Time, xrefs: 00007FF6EB205FB1
Eastern Standard Time, xrefs: 00007FF6EB205F99

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: fef302e48c1cd792944211e73645b005b807e3dc053ca995c02c30257e5353ec
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 57517F23A186428EE710DF31EA956B96761FF4C784F448136EA4DC76B5EF3EE400874A

Function 00007FF6EB1E9280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6EB1E92B3
FindClose.KERNELBASE ref: 00007FF6EB1E92C2

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: ec47a33d0b11cdcad2822813de8fa2dfccb8b407b2d3daf6182ebcfe24391970
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 30F04433A1874286FB608B64B5997BA7350AF88778F040235E96D42AE4DF3DD0598B09

Function 00007FF6EB1E1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6EB1E7F90: _fread_nolock.LIBCMT ref: 00007FF6EB1E803A

_fread_nolock.LIBCMT ref: 00007FF6EB1E1A1B

Part of subcall function 00007FF6EB1E2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6EB1E1B6A), ref: 00007FF6EB1E295E

Strings

Could not allocate memory for archive structure!, xrefs: 00007FF6EB1E1A61
calloc, xrefs: 00007FF6EB1E1A68
Failed to seek to cookie position!, xrefs: 00007FF6EB1E19EE
fread, xrefs: 00007FF6EB1E1A32, 00007FF6EB1E1B5C
malloc, xrefs: 00007FF6EB1E1B22
Could not allocate buffer for TOC!, xrefs: 00007FF6EB1E1B1B
Error on file., xrefs: 00007FF6EB1E1B8D
fseek, xrefs: 00007FF6EB1E19F5
MEI, xrefs: 00007FF6EB1E1991
Could not read full TOC!, xrefs: 00007FF6EB1E1B55
Failed to read cookie!, xrefs: 00007FF6EB1E1A2B

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 507f08f26e205d920f148b85cad333997b9676a31346628d4d7d58e95cedc463
Instruction ID: 8fa599a7ff0a601d252d02d511ac17926e67537b135acf86eb5bf9755e40bec8
Opcode Fuzzy Hash: 507f08f26e205d920f148b85cad333997b9676a31346628d4d7d58e95cedc463
Instruction Fuzzy Hash: A581B173A086868AEB20DB24D0643FD23A0EF4C798F504435DA8DC7BA5DE3EE555874B

Function 00007FF6EB1E1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fwrite, xrefs: 00007FF6EB1E17D1
Failed to extract %s: failed to open target file!, xrefs: 00007FF6EB1E165C
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6EB1E16DA
fread, xrefs: 00007FF6EB1E17E6
Failed to create symbolic link %s!, xrefs: 00007FF6EB1E1622
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6EB1E17DF
malloc, xrefs: 00007FF6EB1E1749
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6EB1E17CA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6EB1E16A2
fseek, xrefs: 00007FF6EB1E16E1
fopen, xrefs: 00007FF6EB1E1663
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6EB1E1742

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 1024a7a5ee8cd7a3c756baff70d017aadc137d22fcd9cea75d224d6f76c21f88
Instruction ID: 55976e044e01c71863ea28f1e775d45d4a88d632d33e08988f90a257304ce721
Opcode Fuzzy Hash: 1024a7a5ee8cd7a3c756baff70d017aadc137d22fcd9cea75d224d6f76c21f88
Instruction Fuzzy Hash: 2B51B023B0864782EA209B1595207FD2390BF4CBA8F904535EE0C87BB5EE3EE555C70B

Function 00007FF6EB1E8660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF6EB1E3CBB), ref: 00007FF6EB1E8704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF6EB1E3CBB), ref: 00007FF6EB1E870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF6EB1E3CBB), ref: 00007FF6EB1E874C

Part of subcall function 00007FF6EB1E8830: GetEnvironmentVariableW.KERNEL32(00007FF6EB1E388E), ref: 00007FF6EB1E8867
Part of subcall function 00007FF6EB1E8830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6EB1E8889

Part of subcall function 00007FF6EB1F8238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F8251

Part of subcall function 00007FF6EB1E2810: MessageBoxW.USER32 ref: 00007FF6EB1E28EA

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6EB1E877E
_MEI%d, xrefs: 00007FF6EB1E8712
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6EB1E86DC
TMP, xrefs: 00007FF6EB1E86C2
TMP, xrefs: 00007FF6EB1E869C, 00007FF6EB1E87A3

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: 4ce1d0f040b71a22ab4aef3914452240e9ec1bd3a31086847a0d7d4c1ead6c46
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: 8E419213A1964285FA21A72599653FD1390AF8C7E8F940131ED0DD7BFAEE3EE501C34A

Function 00007FF6EB1E1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.3.1, xrefs: 00007FF6EB1E1249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6EB1E1276
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6EB1E12BA
malloc, xrefs: 00007FF6EB1E12C1, 00007FF6EB1E12F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6EB1E141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6EB1E12EF

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: b715c76ab38b7b4dfee5c32bc52a61b3ea5d4668c2ab7e2166fd60b1101cc4ae
Instruction ID: 10f61c84e958e37e1d71b456dfb13cc63a6b23abc04c5bbd75ffdcc28d2ca320
Opcode Fuzzy Hash: b715c76ab38b7b4dfee5c32bc52a61b3ea5d4668c2ab7e2166fd60b1101cc4ae
Instruction Fuzzy Hash: EF51C023A0864285EA20AB15A4503FE6291FF887A8F944135ED4DC7BF5EF3EE541C70A

Function 00007FF6EB1E36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6EB1E3804), ref: 00007FF6EB1E36E1
GetLastError.KERNEL32(?,00007FF6EB1E3804), ref: 00007FF6EB1E36EB

Part of subcall function 00007FF6EB1E2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EB1E3706,?,00007FF6EB1E3804), ref: 00007FF6EB1E2C9E
Part of subcall function 00007FF6EB1E2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EB1E3706,?,00007FF6EB1E3804), ref: 00007FF6EB1E2D63
Part of subcall function 00007FF6EB1E2C50: MessageBoxW.USER32 ref: 00007FF6EB1E2D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF6EB1E3739
Failed to convert executable path to UTF-8., xrefs: 00007FF6EB1E3790
\\?\, xrefs: 00007FF6EB1E375A
GetModuleFileNameW, xrefs: 00007FF6EB1E36FA
Failed to obtain executable path., xrefs: 00007FF6EB1E36F3

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 09a6c5356a01b22de160a69859b445b4150499de5f9fc8778fef8e1db76f3cb4
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: F52174A3F1C64245FA219720E9643FA22A1BF8C3A8F404131D55DC69F5FE2EE505C34A

Function 00007FF6EB1FBA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1FBE89

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: 5d462d0b13698e6d5b6ff251167745ceea039769ff6d1662fbf602f1b5ee3c7b
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: B0C1D223A1C68681E7609B1590403FE2B51EF89BA8F754131EA4E877B6CE7EE445C70B

Function 00007FF6EB1E8570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6EB1E8590
OpenProcessToken.ADVAPI32 ref: 00007FF6EB1E85A3
GetTokenInformation.KERNELBASE ref: 00007FF6EB1E85C8
GetLastError.KERNEL32 ref: 00007FF6EB1E85D2
GetTokenInformation.KERNELBASE ref: 00007FF6EB1E8612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6EB1E862E
CloseHandle.KERNEL32 ref: 00007FF6EB1E8646

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: faacf2bfa93a36e6a4bf4aba9bd19615d339c8189aa14e2324ad2d08051f156e
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: B3215E22A0C64242EA208B55B59437EA3A1FFCDBB4F500235EA6D83AF4DF7ED4458705

Function 00007FF6EB1E90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6EB1E8570: GetCurrentProcess.KERNEL32 ref: 00007FF6EB1E8590
Part of subcall function 00007FF6EB1E8570: OpenProcessToken.ADVAPI32 ref: 00007FF6EB1E85A3
Part of subcall function 00007FF6EB1E8570: GetTokenInformation.KERNELBASE ref: 00007FF6EB1E85C8
Part of subcall function 00007FF6EB1E8570: GetLastError.KERNEL32 ref: 00007FF6EB1E85D2
Part of subcall function 00007FF6EB1E8570: GetTokenInformation.KERNELBASE ref: 00007FF6EB1E8612
Part of subcall function 00007FF6EB1E8570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6EB1E862E
Part of subcall function 00007FF6EB1E8570: CloseHandle.KERNEL32 ref: 00007FF6EB1E8646

LocalFree.KERNEL32(?,00007FF6EB1E3C55), ref: 00007FF6EB1E916C
LocalFree.KERNEL32(?,00007FF6EB1E3C55), ref: 00007FF6EB1E9175

Strings

S-1-3-4, xrefs: 00007FF6EB1E9121
D:(A;;FA;;;%s), xrefs: 00007FF6EB1E9157
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6EB1E9142
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6EB1E9183

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction ID: 034933a02a87d19895d58101b584a46a76203b45442068569b9c2778e02a323b
Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction Fuzzy Hash: 94214132A0874186E610AB10E9253FE6261EF8C794F444035EE4D93BA6EF3ED545C786

Function 00007FF6EB1E7E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF6EB1E352C,?,00000000,00007FF6EB1E3F1B), ref: 00007FF6EB1E7F32

Strings

%.*s, xrefs: 00007FF6EB1E7EEB
%s%c, xrefs: 00007FF6EB1E7EA4
\, xrefs: 00007FF6EB1E7E97

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: c0ece0857a3e6e32e7389f2b02d7da915ee091efa867f3946e2973a6db75c34d
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: DE31A532719AC145FA219B21E8507EE6254EF88BF8F440231EE6D87BE9DE2DD6058705

Function 00007FF6EB1FCF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EB1FCF4B), ref: 00007FF6EB1FD07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EB1FCF4B), ref: 00007FF6EB1FD107

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: e8baf931d87f0db565f015147b9e014d00e2803d31ddceb79b4f0d6594ffd814
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: F491C433F1865285F7609F6594503FD2BA0AF48BACF244139DE0EA7AA4DF3AD442C706

Function 00007FF6EB1FF98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6EB1FFA7C
_get_daylight.LIBCMT ref: 00007FF6EB1FFA8D
_get_daylight.LIBCMT ref: 00007FF6EB1FFA9E
_isindst.LIBCMT ref: 00007FF6EB1FFB69

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 7d22d7840cf66a30ce78a1cc8188753238daab9f3959b62b33a556a0aecab2aa
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 9251F173F052528AEB14CB6499A17FC27A5AF583ACF240235DD1E92AF5DF3EA402C705

Function 00007FF6EB1F577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6EB1F57AF
GetFileInformationByHandle.KERNELBASE ref: 00007FF6EB1F5811
GetLastError.KERNEL32 ref: 00007FF6EB1F58A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EB1F56B4), ref: 00007FF6EB1F58EE

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
Instruction ID: cd60373d8a0508a68cbaca068b1048803176c1e9a72c92e0bfb750041f7bbc41
Opcode Fuzzy Hash: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
Instruction Fuzzy Hash: CD515923E186418AFB24CF6194503BD27A1BF48BACF248534DA0D9A6A9DF3AD441C706

Function 00007FF6EB1F5628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F5655
CreateFileW.KERNELBASE ref: 00007FF6EB1F5694
CloseHandle.KERNEL32 ref: 00007FF6EB1F56C9

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: a37e3e2e2766edd3382710247e31d8ce99e2041bf53b8dcfd1aee661b64531d8
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: 66419223D2878283E7108B6095143B96760FF983B8F208335E6AC43AE5EF6DA1E0C745

Function 00007FF6EB1ECC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EB1ECE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6EB1ECE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6EB1ECC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF6EB1ECCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6EB1ECD21

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: db45dfa5c9229f0091b026b3830b0ceb1360a752688e84d76dc5802a0a10f73f
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 18311D23E0824745FA24AB6599253FD1682AF497ACF545434E90DC7AF3DE2FB504C34B

Function 00007FF6EB1F013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F0180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F0277

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: d9e1f1a9e81177000935f6bbd43051899c0de0a57a22996679520af436acd554
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: E451EB63B0D24386EB249E2594047FA6691AF4CBBCF284738DD6D837E5CE3ED501C60A

Function 00007FF6EB1FC134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6EB1FC2CD), ref: 00007FF6EB1FC180
GetLastError.KERNEL32(?,?,?,?,?,00007FF6EB1FC2CD), ref: 00007FF6EB1FC18A

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: ce20b5d7bac61ad7d74c820c0fb7832c750cbfb44bdc34a320e4902043ac7e12
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: CE11046360CA81C1DA208B25B8142A96361AF49FF8F640331EE7D8BBF9CE3ED010C705

Function 00007FF6EB1F5924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EB1F5839), ref: 00007FF6EB1F5957
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EB1F5839), ref: 00007FF6EB1F596D

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: e4b72f3f4ee909edf4403ca1acef619aa82077817100dad9eb577dc0a7a799df
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 1F11913360C74282EB688B14A4113BAB760FF89775F601236F69DC19E8EF6ED014DB05

Function 00007FF6EB1FA948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA95E
GetLastError.KERNEL32(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA968

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 84f052269602601e5bf8e4d154a570161baba4c7604ca1beb51843ceb998fc1e
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: D1E0CD13F2920347FF245BF154653B81651AF8C714F584034C80DC32B1ED2F6885C31A

Function 00007FF6EB1FAB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6EB1FA9D5,?,?,00000000,00007FF6EB1FAA8A), ref: 00007FF6EB1FABC6
GetLastError.KERNEL32(?,?,?,00007FF6EB1FA9D5,?,?,00000000,00007FF6EB1FAA8A), ref: 00007FF6EB1FABD0

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 82e0e1738056d54c91051a59a554d3f1d3055a11a84f74e20703914816e2d280
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 04219222B2868241FEA0575195943F916929F8C7F8F2C4239DA2EC77F1CE6EA441C34A

Function 00007FF6EB1FBEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1FBED4

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 9e622c635b4f1bdfa803b08b20902269ebb49dcffe5c7b9c82d72ec6a00be5d4
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 8C41C33391864187EA34CB19E5503BA77A0EF5D7A8F240131D68EC36E1CF2EE402CB56

Function 00007FF6EB1E7F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6EB1E803A

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 12c7421bf9d851de3930d973ff4776f23e58c204998b3b00b1158df84cf7151e
Instruction ID: 076ddb4e5924e035e9b25df433b13cd12a24f093c1448709341160ee743ed01f
Opcode Fuzzy Hash: 12c7421bf9d851de3930d973ff4776f23e58c204998b3b00b1158df84cf7151e
Instruction Fuzzy Hash: 0E218722B1965246EB519A1265043FE9651BF49BE8F9C4430EE0D87B96DE7EF041C309

Function 00007FF6EB1FB93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1FB9C2

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: 2e9b655ee355e279506a71a13d5ee9f22015a73e471744b066f97627dd9adc5c
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 2C316063E2860285F7216B5598413FD2690BF88BB8F620135E91D873F2CE7EA441C71B

Function 00007FF6EB1F5F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F5EF9

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 29034f590e19cc3173e7bd4038dfc92d5137371ed628435be27a501851862e01
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: FF119923A2C64141EA609F1594003FDA660BF89BA8F654431EE8CD7AB6CF7ED400C74A

Function 00007FF6EB206354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB206377

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 9a632df24b797fba0e1ca3392089f328358987b25e68523c5bc5e19a6e470015
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 67219233A18A428AEB628F58D5503B976A0FF88F54F244234E65DC76E9EF3ED401DB05

Function 00007FF6EB1F03BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F0410

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 6d1ee569445ca7d36f3a9bbbad2117b5a991ba777caca9cc5ad88aca974f6ba5
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 6201A522B1874280E904DF5259052E9A691BF89FF4F684635DE6C93BF6DE3DD401C309

Function 00007FF6EB1FD5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6EB1F0C90,?,?,?,00007FF6EB1F22FA,?,?,?,?,?,00007FF6EB1F3AE9), ref: 00007FF6EB1FD63A

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 2e2df96420a23d757e733bbeb609d9e5dd49221e67ab23c0d0314e4da5725812
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 60F05E12B1820384FE6427B159113F411914F8D7B8F284730DC2ED62F1ED2FA480C21A

Non-executed Functions

Function 00007FF6EB1E5830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E5840
GetLastError.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E5852
GetProcAddress.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E5889
GetLastError.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E589B
GetProcAddress.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E58B4
GetLastError.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E58C6
GetProcAddress.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E58DF
GetLastError.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E58F1
GetProcAddress.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E590D
GetLastError.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E591F
GetProcAddress.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E593B
GetLastError.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E594D
GetProcAddress.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E5969
GetLastError.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E597B
GetProcAddress.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E5997
GetLastError.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E59A9
GetProcAddress.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E59C5
GetLastError.KERNEL32(?,00007FF6EB1E64CF,?,00007FF6EB1E336E), ref: 00007FF6EB1E59D7

Strings

PyConfig_SetString, xrefs: 00007FF6EB1E5A45, 00007FF6EB1E5A67
PyObject_SetAttrString, xrefs: 00007FF6EB1E5D81, 00007FF6EB1E5DA3
PyMem_RawFree, xrefs: 00007FF6EB1E5C9B, 00007FF6EB1E5CBD
PyConfig_Read, xrefs: 00007FF6EB1E59E9, 00007FF6EB1E5A0B
PyErr_Print, xrefs: 00007FF6EB1E5B59, 00007FF6EB1E5B7B
PyObject_Str, xrefs: 00007FF6EB1E5DAF, 00007FF6EB1E5DD1
PyConfig_SetBytesString, xrefs: 00007FF6EB1E5A17, 00007FF6EB1E5A39
Py_DecRef, xrefs: 00007FF6EB1E5836, 00007FF6EB1E5858
PyStatus_Exception, xrefs: 00007FF6EB1E5E39, 00007FF6EB1E5E5B
Py_IsInitialized, xrefs: 00007FF6EB1E5931, 00007FF6EB1E5953
PyMarshal_ReadObjectFromString, xrefs: 00007FF6EB1E5C6D, 00007FF6EB1E5C8F
PyObject_GetAttrString, xrefs: 00007FF6EB1E5D53, 00007FF6EB1E5D75
PyErr_Occurred, xrefs: 00007FF6EB1E5B2B, 00007FF6EB1E5B4D
PyUnicode_Replace, xrefs: 00007FF6EB1E5FD7, 00007FF6EB1E5FF9
PySys_GetObject, xrefs: 00007FF6EB1E5E67, 00007FF6EB1E5E89
PyUnicode_Decode, xrefs: 00007FF6EB1E5EF1, 00007FF6EB1E5F13
PyImport_ExecCodeModule, xrefs: 00007FF6EB1E5C11, 00007FF6EB1E5C33
PyObject_CallFunction, xrefs: 00007FF6EB1E5CF7, 00007FF6EB1E5D19
Py_Finalize, xrefs: 00007FF6EB1E58D5, 00007FF6EB1E58F7
Py_InitializeFromConfig, xrefs: 00007FF6EB1E5903, 00007FF6EB1E5925
PyConfig_SetWideStringList, xrefs: 00007FF6EB1E5A73, 00007FF6EB1E5A95
PySys_SetObject, xrefs: 00007FF6EB1E5E95, 00007FF6EB1E5EB7
PyEval_EvalCode, xrefs: 00007FF6EB1E5BB5, 00007FF6EB1E5BD7
PyUnicode_DecodeFSDefault, xrefs: 00007FF6EB1E5F1F, 00007FF6EB1E5F41
PyUnicode_FromString, xrefs: 00007FF6EB1E5F7B, 00007FF6EB1E5F9D
PyErr_NormalizeException, xrefs: 00007FF6EB1E5AFD, 00007FF6EB1E5B1F
Py_DecodeLocale, xrefs: 00007FF6EB1E587F, 00007FF6EB1E58A1
PyModule_GetDict, xrefs: 00007FF6EB1E5CC9, 00007FF6EB1E5CEB
PyObject_CallFunctionObjArgs, xrefs: 00007FF6EB1E5D25, 00007FF6EB1E5D47
PyConfig_Clear, xrefs: 00007FF6EB1E598D, 00007FF6EB1E59AF
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6EB1E5DDD, 00007FF6EB1E5DFF
PyUnicode_AsUTF8, xrefs: 00007FF6EB1E5EC3, 00007FF6EB1E5EE5
PyImport_AddModule, xrefs: 00007FF6EB1E5BE3, 00007FF6EB1E5C05
Py_ExitStatusException, xrefs: 00007FF6EB1E58AA, 00007FF6EB1E58CC
PyConfig_InitIsolatedConfig, xrefs: 00007FF6EB1E59BB, 00007FF6EB1E59DD
Failed to get address for %hs, xrefs: 00007FF6EB1E5861
Py_PreInitialize, xrefs: 00007FF6EB1E595F, 00007FF6EB1E5981
PyErr_Fetch, xrefs: 00007FF6EB1E5ACF, 00007FF6EB1E5AF1
PyUnicode_FromFormat, xrefs: 00007FF6EB1E5F4D, 00007FF6EB1E5F6F
PyRun_SimpleStringFlags, xrefs: 00007FF6EB1E5E0B, 00007FF6EB1E5E2D
PyErr_Restore, xrefs: 00007FF6EB1E5B87, 00007FF6EB1E5BA9
PyImport_ImportModule, xrefs: 00007FF6EB1E5C3F, 00007FF6EB1E5C61
PyUnicode_Join, xrefs: 00007FF6EB1E5FA9, 00007FF6EB1E5FCB
GetProcAddress, xrefs: 00007FF6EB1E5868
PyErr_Clear, xrefs: 00007FF6EB1E5AA1, 00007FF6EB1E5AC3

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 06694f8e918ae061de7e9462366dc7ea0c78f202396fa894a3c40fb1c428eb78
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: B822D76290DB0799FA159B11AA787B823A1AF0C759F545035C81FC26B4FF3FA448D30B

Function 00007FF6EB2040AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6EB2040FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB204766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2048DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB204B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB204DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB204FF7
memcpy_s.LIBCPMT ref: 00007FF6EB2050D2
memcpy_s.LIBCPMT ref: 00007FF6EB20517D
memcpy_s.LIBCPMT ref: 00007FF6EB20524C

Strings

1#SNAN, xrefs: 00007FF6EB20420A
1#IND, xrefs: 00007FF6EB2041E7
1#QNAN, xrefs: 00007FF6EB204213
1#INF, xrefs: 00007FF6EB204223

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: 86b1082295ea051c21615dd16698bbccc0938001781c3bbd2522938291ac447c
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: D5B2F573E182828FE7248E64D6607FD37B1FF58388F509135DA1997AA4EF39A900CB45

Function 00007FF6EB1E83C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF6EB1E8919,00007FF6EB1E3F9D), ref: 00007FF6EB1E842B
RemoveDirectoryW.KERNEL32(?,00007FF6EB1E8919,00007FF6EB1E3F9D), ref: 00007FF6EB1E84AE
DeleteFileW.KERNEL32(?,00007FF6EB1E8919,00007FF6EB1E3F9D), ref: 00007FF6EB1E84CD
FindNextFileW.KERNEL32(?,00007FF6EB1E8919,00007FF6EB1E3F9D), ref: 00007FF6EB1E84DB
FindClose.KERNEL32(?,00007FF6EB1E8919,00007FF6EB1E3F9D), ref: 00007FF6EB1E84EC
RemoveDirectoryW.KERNEL32(?,00007FF6EB1E8919,00007FF6EB1E3F9D), ref: 00007FF6EB1E84F5

Strings

%s\*, xrefs: 00007FF6EB1E83F2

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: eec85a3fe6a272a35bbc63d841becfaa0187e350df8742d392f81c6a057e2f39
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 3F414123A0C94285EA319B64E4583FE6360FF9C768F400232D99EC2AE4EF3ED5458756

Function 00007FF6EB1EACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid code -- missing end-of-block, xrefs: 00007FF6EB1EB0C6
too many length or distance symbols, xrefs: 00007FF6EB1EAE46
invalid distance too far back, xrefs: 00007FF6EB1EB670
invalid bit length repeat, xrefs: 00007FF6EB1EB099
invalid distances set, xrefs: 00007FF6EB1EB1A0
invalid literal/lengths set, xrefs: 00007FF6EB1EB133
invalid literal/length code, xrefs: 00007FF6EB1EB3E2
invalid code lengths set, xrefs: 00007FF6EB1EAE2D
invalid distance code, xrefs: 00007FF6EB1EB5B4

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction ID: 2989f81aa58d8fec9806d0fbc0550d5d9e05a47644529022d61b425206a6cf9b
Opcode Fuzzy Hash: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction Fuzzy Hash: 1052F873A146A64BD7A48F14C498BBE3BA9FB48354F014139E64AC7B90DF3EE844CB45

Function 00007FF6EB1ED12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6EB1ED148
RtlCaptureContext.KERNEL32 ref: 00007FF6EB1ED175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6EB1ED18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6EB1ED1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF6EB1ED224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6EB1ED241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6EB1ED24C

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: dbbb642f3e1f902c89c3ec90be070ca6b9441271762b07ddfb7f753eef4d0a89
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: D6315273608B818AEB608F60E8543FD7360FB88748F444039DA4D97BA4EF39D548C715

Function 00007FF6EB1FA614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6EB1FA68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6EB1FA6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6EB1FA6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF6EB1FA719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6EB1FA723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6EB1FA72E

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: f88884c3b04b57e9e04518119ed02fc202981aa3538a8c3318c19e9c7d7036c4
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: A3317E37618B818ADB20CB24E8543AE73A4FF88758F540135EA9D83BA4EF3ED145CB05

Function 00007FF6EB201874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2018C0
FindFirstFileExW.KERNEL32 ref: 00007FF6EB2019CA

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: 39956d780c6c448a369294d0e92e06304e140337bc94248455743ee517d3e3fe
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: D2B1D523B1868645EA619B2296203F963A0EF48BE5F544131FE4D87BE9FF3DE441D306

Function 00007FF6EB1ED010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6EB1ED03C
GetCurrentThreadId.KERNEL32 ref: 00007FF6EB1ED04A
GetCurrentProcessId.KERNEL32 ref: 00007FF6EB1ED056
QueryPerformanceCounter.KERNEL32 ref: 00007FF6EB1ED066

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 86e94e992e15bc326c9956718cbbac007dd296c1d4820aa0e500becad1ba5999
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 77114822B14B058EEB00DB60E9683B933A4FB1D758F080E31DA2D86BA4EF39D1598345

Function 00007FF6EB203C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6EB203C76
memcpy_s.LIBCPMT ref: 00007FF6EB203CA1

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 1e04d301bdf0c29c23cf7b8e49baf0cfa50768369c0af073d24a05e0442aa027
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: AEC1E373B182868BD7248F15A25477AB7A1FB9CB84F40C135DB5A93764EE3EE801CB44

Function 00007FF6EB1EA47B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF6EB1EA4C5
, xrefs: 00007FF6EB1EA55B
header crc mismatch, xrefs: 00007FF6EB1EA921

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction ID: 9ba2f3669c01e026f5eb742490c658da4694a6d925855af7637def8b34509aa2
Opcode Fuzzy Hash: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction Fuzzy Hash: 92F1B673A243C54BE7A58F14C088B7E3AE9EF49758F164538DA4987BA0CF3AE440C785

Function 00007FF6EB209728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6EB209977
RaiseException.KERNEL32 ref: 00007FF6EB209988

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: fa3fdbe5d0eade745db14f1bfba9509ea3a3f9f0cf727087bd8491641b8b9cdb
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: B8B13B73604B898EEB19CF2DC95636877A0FB88B48F148921DA5E837B4DF3AD451C705

Function 00007FF6EB1F39A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6EB1F3B12
, xrefs: 00007FF6EB1F3D54

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: 50d2e88e2afd57dfef32320ad6e92d0ed6ab0b67f88656b7d82a17eb8533fc4a
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: 26E18733A0864685DB688F25A2502BD3360FF49BACF345135DA4EC76B4DF2BE851C74A

Function 00007FF6EB1EA2DB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF6EB1EA462
invalid window size, xrefs: 00007FF6EB1EA449

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction ID: b4afe92a09c6a29affb5850b755b9b1c234e3e9d90fc73c65b06164c5dfb5615
Opcode Fuzzy Hash: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction Fuzzy Hash: 18919A73A182C687E7A48E15C488B7F3A99FF48368F154135DA4A86BA4CF39E540CB45

Function 00007FF6EB1FDEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF6EB1FE07A
e+000, xrefs: 00007FF6EB1FDFFD

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: 69f36759a30bdae8e1cfb66b2ad696bd5294655dfae1be1b1cfe6edbfc2dbb13
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 9B514763B1C2C546E7258F35A8007A96B91EB48BA8F588231CB9887BE5CF3ED445C706

Function 00007FF6EB2008C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
Instruction ID: 17b484e21997c09ebf134ef41445372a0c1606dcaab1e8b2ccba4ac1a5b05a6f
Opcode Fuzzy Hash: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
Instruction Fuzzy Hash: C502F623A2D64B48FA519B1166213BA2691BF0DBA4F548635DD5DCB3F1EE3FF401830A

Function 00007FF6EB1FDA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6EB1FDD9E

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 1846bbf90a82419bcd668f856bad8332260de133b80d432686bbc7fc56305d01
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: F6A15663A0878946EB21CF25A0107F97B91AF59BE8F248131DE8D977A5DE3EE401C706

Function 00007FF6EB1F8794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6EB1F87B3

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: 48b64266974409730b14e8949ab9611209f42b4f3f341a1e163c1356dc952fd0
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: CC519413F2864281FA65962659113BA5290AF8CBECF684434DD0ED77F6EE3EE405C24A

Function 00007FF6EB203480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6EB203484

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: b575adc5ca98b43284c2a789a401005524c176d074632b40d8cdfcab517e4fae
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: 94B09221E27A02CEEA082B216E9633822A47F4C700F984238C00CC1330EE2E24E65706

Function 00007FF6EB1F35A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: c84a8b5bb3b9fc500dba92c3761113fae0fde242b0fbfb5e06327aaaa622fa89
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: 0BD19363A0864285EB688B25A2503BD27A0EF49B6CF344235CE0D877B5DF3FD945C74A

Function 00007FF6EB1E9800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: bdbe2836b55b21743b5058ef3404e50d4609c70d88c71d551330943c45a5c453
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 20C1CE722181E08BD289EB29E4794BA73D1F78934DB95406BEF8747BC5CB3CA414DB11

Function 00007FF6EB1F2C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: 0dfa09eeeb13fcc6edd57b9c6ee9d3f7c34ea46b6c70214a9e6f8070e109a81e
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: 2AB17C73918A8585E764CF29C0502BC3BA0EB49B6CF380135EA5E873A5CF2AD451C78B

Function 00007FF6EB1FE570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: 3b49bba09c1b1572e585fada5869ce1338fd06bdb0641721207c611a3c9356dd
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: 0C81B673A0C78146DB74CB19E4403B96A91FF497A8F244235DA8D87BA9DF3ED500CB05

Function 00007FF6EB206418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
Instruction ID: bf2f7b63f9019c4c4cf7215901726ba500b795720d015e597e5181274d44ea81
Opcode Fuzzy Hash: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
Instruction Fuzzy Hash: 9C61F923E182524EF7768AA8956077D6680AF4D774F140239E61DC3AF5FE6FE800D70A

Function 00007FF6EB1F2164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 22a3e7038bcf8883f9624a125bc4cf907f71a9f63fb1e217b09f347523bf3073
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 99515477A18A5186E7248B29C4503A827A1EF5CB7CF344131DA5D877A4CF3BE943C78A

Function 00007FF6EB1F1944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: adbde3cd9afc6a8d047024fa54affac11a9dca1ecf2d85ca3281237846ab804f
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: A3515377A14A5186E7248B29C0543A837A1EF48F6CF344135CA8D977A8DF3BE863C785

Function 00007FF6EB1F1D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 65179cbda554ca5c2df3aa07b9e2456009a7ec53bae06536b99a18f667983869
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: AE517C37A1865182E7248B29C0543A833A1EF49B7CF384135CA4D877A5CF3BE862C785

Function 00007FF6EB1F1B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: d2a9d78dda62beeb7d725937960927fd82486a43f30d750c154ed2a87af9e9e6
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: BE519F37A18A51C6E7248B29C0443A827B1EF49FACF385131CA4C977A4DF3BE862C745

Function 00007FF6EB1F1F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 5211eb712c54a3969ecdaa84835f697c23b87155ca4b39955b205783717994e2
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 1A516D37A1865185E7248B29C0503A827A0EF49B6CF344131DA5D977A5CF3BEC53C78A

Function 00007FF6EB1F1740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: b322d22516b20d455feefb184d2477fd882b1986dd3175ac65ee5517adb2b825
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: EB513277A1865185EB248B29C0443A827A1EF49B6CF384131CE4D977B8CF3BE862D785

Function 00007FF6EB1F5D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: ebe078a7fc9b3b5e0370d0a4e9a980119b3998113810ea7aa46398b0333d39c5
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 8241B26380AB4A05E9AA891805087F46A81BF1ABB8D7812B4DD9DD73F3CD0F6587C206

Function 00007FF6EB1F9EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: 4f0c6155730816792ba983e81c7e095f94a0b776dea5e2585958850a02a2902b
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: CA41D223714A5586EF04CF6AEA142A963A5FF4CFD4B199032EE0DD7B68DE3ED0418345

Function 00007FF6EB1F80E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
Instruction ID: 89e804fe7da3f34690c2d255a31c26b8e3d6aa94cc86ce62236d390053a0a6fb
Opcode Fuzzy Hash: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
Instruction Fuzzy Hash: 3931C133B1CB4285E7659B25644027E6AD5AF88BE4F244238EA4E97BF5DF3DD0028709

Function 00007FF6EB209570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: 2cebf0f229b9a22c7e1301a3d943a0c808d3dc4d3406dfcfbe5362be2bb52492
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 18F044727286958EDBA88F6DA50263977D0FB08380F40C439E589C3A24DE3D91518F49

Function 00007FF6EB1ED30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: 6bb5dd8434bd8b468d907060a9a6442f9e892ef73fb1551d6c396c57c1c88e53
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: B1A00263D0CC0AD8E6548B10E9B42792330FF5C714B801071E00DE14B0AF3FA905D30A

Function 00007FF6EB1E76C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6EB1E76D7
GetLastError.KERNEL32 ref: 00007FF6EB1E76E9
GetProcAddress.KERNEL32 ref: 00007FF6EB1E7725
GetLastError.KERNEL32 ref: 00007FF6EB1E7737
GetProcAddress.KERNEL32 ref: 00007FF6EB1E7750
GetLastError.KERNEL32 ref: 00007FF6EB1E7762
GetProcAddress.KERNEL32 ref: 00007FF6EB1E777B
GetLastError.KERNEL32 ref: 00007FF6EB1E778D
GetProcAddress.KERNEL32 ref: 00007FF6EB1E77A9
GetLastError.KERNEL32 ref: 00007FF6EB1E77BB
GetProcAddress.KERNEL32 ref: 00007FF6EB1E77D7
GetLastError.KERNEL32 ref: 00007FF6EB1E77E9
GetProcAddress.KERNEL32 ref: 00007FF6EB1E7805
GetLastError.KERNEL32 ref: 00007FF6EB1E7817
GetProcAddress.KERNEL32 ref: 00007FF6EB1E7833
GetLastError.KERNEL32 ref: 00007FF6EB1E7845
GetProcAddress.KERNEL32 ref: 00007FF6EB1E7861
GetLastError.KERNEL32 ref: 00007FF6EB1E7873

Strings

Tcl_EvalObjv, xrefs: 00007FF6EB1E7BEF, 00007FF6EB1E7C11
Tcl_CreateObjCommand, xrefs: 00007FF6EB1E7A7F, 00007FF6EB1E7AA1
Tcl_EvalEx, xrefs: 00007FF6EB1E7BC1, 00007FF6EB1E7BE3
Tcl_DeleteInterp, xrefs: 00007FF6EB1E77FB, 00007FF6EB1E781D
Tcl_CreateInterp, xrefs: 00007FF6EB1E771B, 00007FF6EB1E773D
Tk_GetNumMainWindows, xrefs: 00007FF6EB1E7CA7, 00007FF6EB1E7CC9
Tcl_CreateThread, xrefs: 00007FF6EB1E7829, 00007FF6EB1E784B
Tcl_SetVar2Ex, xrefs: 00007FF6EB1E7B37, 00007FF6EB1E7B59
Tcl_Alloc, xrefs: 00007FF6EB1E7C1D, 00007FF6EB1E7C3F
Tk_Init, xrefs: 00007FF6EB1E7C79, 00007FF6EB1E7C9B
Tcl_FindExecutable, xrefs: 00007FF6EB1E7746, 00007FF6EB1E7768
Tcl_JoinThread, xrefs: 00007FF6EB1E7885, 00007FF6EB1E78A7
Tcl_DoOneEvent, xrefs: 00007FF6EB1E7771, 00007FF6EB1E7793
Tcl_SetVar2, xrefs: 00007FF6EB1E7A51, 00007FF6EB1E7A73
Tcl_MutexFinalize, xrefs: 00007FF6EB1E790F, 00007FF6EB1E7931
Tcl_GetString, xrefs: 00007FF6EB1E7AAD, 00007FF6EB1E7ACF
Tcl_ConditionNotify, xrefs: 00007FF6EB1E796B, 00007FF6EB1E798D
Tcl_Free, xrefs: 00007FF6EB1E7C4B, 00007FF6EB1E7C6D
Tcl_GetVar2, xrefs: 00007FF6EB1E7A23, 00007FF6EB1E7A45
Tcl_GetObjResult, xrefs: 00007FF6EB1E7B65, 00007FF6EB1E7B87
Tcl_NewByteArrayObj, xrefs: 00007FF6EB1E7B09, 00007FF6EB1E7B2B
Tcl_ConditionWait, xrefs: 00007FF6EB1E7999, 00007FF6EB1E79BB
Tcl_ConditionFinalize, xrefs: 00007FF6EB1E793D, 00007FF6EB1E795F
Tcl_ThreadQueueEvent, xrefs: 00007FF6EB1E79C7, 00007FF6EB1E79E9
Tcl_ThreadAlert, xrefs: 00007FF6EB1E79F5, 00007FF6EB1E7A17
Tcl_Init, xrefs: 00007FF6EB1E76D0, 00007FF6EB1E76EF
Failed to get address for %hs, xrefs: 00007FF6EB1E76F8
Tcl_Finalize, xrefs: 00007FF6EB1E779F, 00007FF6EB1E77C1
Tcl_GetCurrentThread, xrefs: 00007FF6EB1E7857, 00007FF6EB1E7879
Tcl_MutexLock, xrefs: 00007FF6EB1E78B3, 00007FF6EB1E78D5
Tcl_MutexUnlock, xrefs: 00007FF6EB1E78E1, 00007FF6EB1E7903
Tcl_EvalFile, xrefs: 00007FF6EB1E7B93, 00007FF6EB1E7BB5
Tcl_NewStringObj, xrefs: 00007FF6EB1E7ADB, 00007FF6EB1E7AFD
GetProcAddress, xrefs: 00007FF6EB1E76FF
Tcl_FinalizeThread, xrefs: 00007FF6EB1E77CD, 00007FF6EB1E77EF

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 1c03ade8e552eac573919468264e8cb30a907f04ed74485d1e210aa59680732e
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: FB02DB3690EB0799FA159B54AA787B82361AF0C799F440031D92ED2674FF3FB549830B

Function 00007FF6EB1E81D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EB1E9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6EB1E45F4,00000000,00007FF6EB1E1985), ref: 00007FF6EB1E93C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6EB1E86B7,?,?,00000000,00007FF6EB1E3CBB), ref: 00007FF6EB1E822C

Part of subcall function 00007FF6EB1E2810: MessageBoxW.USER32 ref: 00007FF6EB1E28EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6EB1E8373
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6EB1E82D9
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6EB1E8203
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6EB1E829D
CreateDirectory, xrefs: 00007FF6EB1E837C
%.*s, xrefs: 00007FF6EB1E830C
\, xrefs: 00007FF6EB1E8261
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6EB1E8240

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: cb38b79eb329c8781a810b48efe95484843f8317c8f76a08c21e39363a98bf7d
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: E251D813A2D64345FA619B24E9617FE6390AF8C798F544431DA0EC2AF5FE3EE104C34A

Function 00007FF6EB1E2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6EB1E21AB
SelectObject.GDI32 ref: 00007FF6EB1E21F2
DrawTextW.USER32 ref: 00007FF6EB1E2215
SelectObject.GDI32 ref: 00007FF6EB1E222B
ReleaseDC.USER32 ref: 00007FF6EB1E223B
MoveWindow.USER32 ref: 00007FF6EB1E228B
MoveWindow.USER32 ref: 00007FF6EB1E22CB
MoveWindow.USER32 ref: 00007FF6EB1E231E
MoveWindow.USER32 ref: 00007FF6EB1E2366

Strings

P%, xrefs: 00007FF6EB1E21FF

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 7e1b032e8f912ceb1c9096b761dca54b5f05094b9a725fcd86fd722a725ced48
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: A25108266047A186D6349F36E4282BAB7A1FB9CB65F004121EFDE83694EF3DD045DB14

Function 00007FF6EB1E80C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6EB1E80FF
GetWindowLongPtrW.USER32 ref: 00007FF6EB1E817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF6EB1E8192
GetLastError.KERNEL32 ref: 00007FF6EB1E819C
SetWindowLongPtrW.USER32 ref: 00007FF6EB1E81B3

Strings

Needs to remove its temporary files., xrefs: 00007FF6EB1E8185

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 495712b4ef4d3a20fdbf746f4730e8bdf72a1e18b623ce187ab5767ffd649a1e
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 83218823B08A42C6E7558B79A96837D6250EF8CBA4F584131DA1DC37F4EE2ED5918306

Function 00007FF6EB1F6290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F62D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F66C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F695C

Strings

f, xrefs: 00007FF6EB1F63F5
-, xrefs: 00007FF6EB1F6369
:, xrefs: 00007FF6EB1F648C
p, xrefs: 00007FF6EB1F63FD
p, xrefs: 00007FF6EB1F6385

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: cadc13aab15f216bbfc5b51695d89c4992480e16a93f0138787a624011a83e60
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 9412A663E0C24386FB205E94D1543F97652FF587B8FA84135D689866E8DF3EE580CB0A

Function 00007FF6EB1F0FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F1008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F13D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F166F

Strings

p, xrefs: 00007FF6EB1F1112
p, xrefs: 00007FF6EB1F10AD
f, xrefs: 00007FF6EB1F10A0
f, xrefs: 00007FF6EB1F110A
f, xrefs: 00007FF6EB1F1255

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 4bd560ae9d348da2231f950f80d655f41abf8abf5d37353e0d400c7f817a1b16
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: D012D863E0C14385FB209A14E0547F976A1FF85778FA84131D68A879E4DF7EE5A0CB0A

Function 00007FF6EB1E1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6EB1E10CC
fread, xrefs: 00007FF6EB1E11FD
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6EB1E11F6
malloc, xrefs: 00007FF6EB1E110F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6EB1E1098
fseek, xrefs: 00007FF6EB1E10D3
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6EB1E1108

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: d887d44ea8411714a319a2ddb58e34d6532429a931d40157cb204db5ad1c3ab0
Instruction ID: 23c798356231c3d95fbf78ea29e32a3acffb1422a82836c124f68a504e2dd76f
Opcode Fuzzy Hash: d887d44ea8411714a319a2ddb58e34d6532429a931d40157cb204db5ad1c3ab0
Instruction Fuzzy Hash: E9417023A1865286EA10DB25A8147FD6391BF4CBE8F944432ED0C87BB5DE3EE501C74B

Function 00007FF6EB1E1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6EB1E14DE
fread, xrefs: 00007FF6EB1E15E6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6EB1E15DF
malloc, xrefs: 00007FF6EB1E151F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6EB1E149F
fseek, xrefs: 00007FF6EB1E14E5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6EB1E1518

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 04eae6a6e28014538c265d314aaf186d5e7ccf6377acaf4908732b6d0be74f73
Instruction ID: 07115cb0ff7975b6382aad05fb4a6e47fc2d0182e42044d24344e4875a9d7808
Opcode Fuzzy Hash: 04eae6a6e28014538c265d314aaf186d5e7ccf6377acaf4908732b6d0be74f73
Instruction Fuzzy Hash: 9A418123A0864285EB10DB2195107F96390FF4D7A8F944532ED0D87BB9DE3EE551CB0B

Function 00007FF6EB1EEA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6EB1EEA65

Part of subcall function 00007FF6EB1EF9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6EB1EF9FF
Part of subcall function 00007FF6EB1EF9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6EB1EFA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6EB1EEB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6EB1EED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6EB1EEE98

Strings

csm, xrefs: 00007FF6EB1EEAE6
csm, xrefs: 00007FF6EB1EEA7F
csm, xrefs: 00007FF6EB1EEB60

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: d4c95464d14b78ca7357305d1e2b5a6cf7d1f1ec0153e6ca4e088ffd9b35a19c
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 59D17D23A087418AEB609B65A4403ED77A0FB497ACF100135EE8D97FA5DF3AE484C706

Function 00007FF6EB1FED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6EB1FF0AA,?,?,000002147A438B48,00007FF6EB1FAD53,?,?,?,00007FF6EB1FAC4A,?,?,?,00007FF6EB1F5F3E), ref: 00007FF6EB1FEE8C
GetProcAddress.KERNEL32(?,?,?,00007FF6EB1FF0AA,?,?,000002147A438B48,00007FF6EB1FAD53,?,?,?,00007FF6EB1FAC4A,?,?,?,00007FF6EB1F5F3E), ref: 00007FF6EB1FEE98

Strings

api-ms-, xrefs: 00007FF6EB1FEDD6
ext-ms-, xrefs: 00007FF6EB1FEDE9

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: c42f4869c4cbcc5c260d3dec24c84074fa90224bc968b218abad68a56297f31d
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: B541F323B19A0245EA15CB16B9147B92292BF4CBA4F984539DD1DC7BA4EE3EE405C30A

Function 00007FF6EB1E2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EB1E3706,?,00007FF6EB1E3804), ref: 00007FF6EB1E2C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EB1E3706,?,00007FF6EB1E3804), ref: 00007FF6EB1E2D63
MessageBoxW.USER32 ref: 00007FF6EB1E2D99

Strings

%ls: , xrefs: 00007FF6EB1E2D22
<FormatMessageW failed.>, xrefs: 00007FF6EB1E2D70
Error, xrefs: 00007FF6EB1E2D8C
[PYI-%d:ERROR] , xrefs: 00007FF6EB1E2CA6

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: b6e4db40cac030e665c1b7ce8baefc643439113a675fff17e780f54b63930dc0
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 0131E523708A4146E620AB25A9243FA6791BF8CB98F400135EF4DD3B69EF3ED50AC345

Function 00007FF6EB1EDCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6EB1EDF7A,?,?,?,00007FF6EB1EDC6C,?,?,?,00007FF6EB1ED869), ref: 00007FF6EB1EDD4D
GetLastError.KERNEL32(?,?,?,00007FF6EB1EDF7A,?,?,?,00007FF6EB1EDC6C,?,?,?,00007FF6EB1ED869), ref: 00007FF6EB1EDD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6EB1EDF7A,?,?,?,00007FF6EB1EDC6C,?,?,?,00007FF6EB1ED869), ref: 00007FF6EB1EDD85
FreeLibrary.KERNEL32(?,?,?,00007FF6EB1EDF7A,?,?,?,00007FF6EB1EDC6C,?,?,?,00007FF6EB1ED869), ref: 00007FF6EB1EDDF3
GetProcAddress.KERNEL32(?,?,?,00007FF6EB1EDF7A,?,?,?,00007FF6EB1EDC6C,?,?,?,00007FF6EB1ED869), ref: 00007FF6EB1EDDFF

Strings

api-ms-, xrefs: 00007FF6EB1EDD6D

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: a340ded98040b445144d6789c3e1b6f18b08fa96fb1509bba81456036a2b7af0
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 2131C123B1A60295EE219B0694143F92394FF4CBB8F595535DD1ED6BE0EF3EE444830A

Function 00007FF6EB1E6360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6EB1E6407
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6EB1E63C7
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6EB1E6456
Failed to load Python DLL '%ls'., xrefs: 00007FF6EB1E64A7
LoadLibrary, xrefs: 00007FF6EB1E64AE
ucrtbase.dll, xrefs: 00007FF6EB1E63DD

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: c09c5ca4b44f5ac09c2c6f2e1c89924df1c26c48483e95282415f98aa7d90b4f
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: 15418473A1868691EA15DB20E5243FD6351FF5C3A8F900132DA5C83AB9EF3DE505C746

Function 00007FF6EB1E2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6EB1E351A,?,00000000,00007FF6EB1E3F1B), ref: 00007FF6EB1E2AA0

Strings

0, xrefs: 00007FF6EB1E2B16
[PYI-%d:%s] , xrefs: 00007FF6EB1E2AA8
Warning, xrefs: 00007FF6EB1E2B1E
Warning [ANSI Fallback], xrefs: 00007FF6EB1E2B0F
WARNING, xrefs: 00007FF6EB1E2AAF

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 7ad7ca9423b52876bb0f60ae396073241b2c246a05ac528bfa8412411d3ca3fa
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 6A219F33A1878186E7209B51B8917EA6394FF8C794F400136FE8C83A69EF3DD245C745

Function 00007FF6EB1FB150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6EB1FB15F
FlsGetValue.KERNEL32 ref: 00007FF6EB1FB174
FlsSetValue.KERNEL32 ref: 00007FF6EB1FB195
FlsSetValue.KERNEL32 ref: 00007FF6EB1FB1C2
FlsSetValue.KERNEL32 ref: 00007FF6EB1FB1D3
FlsSetValue.KERNEL32 ref: 00007FF6EB1FB1E4
SetLastError.KERNEL32 ref: 00007FF6EB1FB1FF

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
Instruction ID: 6155259c248fe08b13a8cd9babfe1c9204d8af83c37d45323419a725d81280f5
Opcode Fuzzy Hash: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
Instruction Fuzzy Hash: 67215022B0D64285F6646321AA553BE52526F4C7B8F344634D93EC76F6DD6FB401C30B

Function 00007FF6EB207D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6EB207D9D
GetLastError.KERNEL32 ref: 00007FF6EB207DA9
CloseHandle.KERNEL32 ref: 00007FF6EB207DC1
CreateFileW.KERNEL32 ref: 00007FF6EB207DEC
WriteConsoleW.KERNEL32 ref: 00007FF6EB207E0B

Strings

CONOUT$, xrefs: 00007FF6EB207DCD

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 54c2e28f3156130dc7227c29b7ebe463976f37a5c60950bfab60d39b11b6fdab
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 86119632B18A418AE7609B12F96833962A0FF8CBE4F040234DA5DC77B4DF3ED4148749

Function 00007FF6EB1E8ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6EB1E3FA9), ref: 00007FF6EB1E8EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6EB1E3FA9), ref: 00007FF6EB1E8F5A

Part of subcall function 00007FF6EB1E9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6EB1E45F4,00000000,00007FF6EB1E1985), ref: 00007FF6EB1E93C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6EB1E3FA9), ref: 00007FF6EB1E8FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6EB1E3FA9), ref: 00007FF6EB1E9044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6EB1E3FA9), ref: 00007FF6EB1E9055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6EB1E3FA9), ref: 00007FF6EB1E906A

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: d4e101c5a1182f72767d65aaa9f32455afd2108b3e22fe95266f0ea1e3bb1c81
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: 49417473A1968181EA309B12A9003FE7394EF89BE8F444135DF5D97BA9DE3EE500C709

Function 00007FF6EB1FB2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6EB1F4F11,?,?,?,?,00007FF6EB1FA48A,?,?,?,?,00007FF6EB1F718F), ref: 00007FF6EB1FB2D7
FlsSetValue.KERNEL32(?,?,?,00007FF6EB1F4F11,?,?,?,?,00007FF6EB1FA48A,?,?,?,?,00007FF6EB1F718F), ref: 00007FF6EB1FB30D
FlsSetValue.KERNEL32(?,?,?,00007FF6EB1F4F11,?,?,?,?,00007FF6EB1FA48A,?,?,?,?,00007FF6EB1F718F), ref: 00007FF6EB1FB33A
FlsSetValue.KERNEL32(?,?,?,00007FF6EB1F4F11,?,?,?,?,00007FF6EB1FA48A,?,?,?,?,00007FF6EB1F718F), ref: 00007FF6EB1FB34B
FlsSetValue.KERNEL32(?,?,?,00007FF6EB1F4F11,?,?,?,?,00007FF6EB1FA48A,?,?,?,?,00007FF6EB1F718F), ref: 00007FF6EB1FB35C
SetLastError.KERNEL32(?,?,?,00007FF6EB1F4F11,?,?,?,?,00007FF6EB1FA48A,?,?,?,?,00007FF6EB1F718F), ref: 00007FF6EB1FB377

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
Instruction ID: 9ece6ffd41191d2e8d67e15b39520652f8d139208fea7404428e375f14b84f27
Opcode Fuzzy Hash: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
Instruction Fuzzy Hash: 52118E22A4D64286FA546321AA553BE1252AF4C7F8F344734D82EC76F6DE2FA501C30B

Function 00007FF6EB1E2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6EB1E1B6A), ref: 00007FF6EB1E295E

Strings

Error, xrefs: 00007FF6EB1E2A0E
Error [ANSI Fallback], xrefs: 00007FF6EB1E29FF
[PYI-%d:ERROR] , xrefs: 00007FF6EB1E2966
%s: %s, xrefs: 00007FF6EB1E29E8

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: 47c1e6d97fe3e986c7f44cc42efa5b7e52fcc3c8bbda0bfdae04536e04b4495e
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 5A31E223B1868156E720A761A8507FA6294BF8C7E8F400132EE8DC3B69EF3DE546C305

Function 00007FF6EB1E2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6EB1E23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF6EB1E248E
DeleteObject.GDI32 ref: 00007FF6EB1E24C1
DestroyIcon.USER32 ref: 00007FF6EB1E24D3

Strings

Unhandled exception in script, xrefs: 00007FF6EB1E23F8

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: e703c722d5ae4059f0211456f13f825b4807100a09f6709d6b183593c2794b09
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: AD319073619A8289EB20DB21E8653F96360FF8C798F440135EA4D87B69DF3DD104C706

Function 00007FF6EB1E2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6EB1E918F,?,00007FF6EB1E3C55), ref: 00007FF6EB1E2BA0
MessageBoxW.USER32 ref: 00007FF6EB1E2C2A

Strings

Warning, xrefs: 00007FF6EB1E2C1D
WARNING, xrefs: 00007FF6EB1E2BAF
[PYI-%d:%ls] , xrefs: 00007FF6EB1E2BA8

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: e7c96de6911f2baf99c061d224607d332b8571b5bb62474ae4984b71934f0fc9
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 0821BC23708B4186E7209B14B8647EA63A4EF8C794F400136EA8D93A69EF3DE205C745

Function 00007FF6EB1E2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6EB1E1B99), ref: 00007FF6EB1E2760

Strings

[PYI-%d:%s] , xrefs: 00007FF6EB1E2768
Error, xrefs: 00007FF6EB1E27DE
Error [ANSI Fallback], xrefs: 00007FF6EB1E27CF
ERROR, xrefs: 00007FF6EB1E276F

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 688a9c08c1de58a7eb7bf737865fe18057b2043baed5d64d0af892f613bc5e01
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: F421AE33A18B8196E720DB50B9917EAA394FF8C794F400131FE8C93A69EF7DE2458745

Function 00007FF6EB1F9A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6EB1F9AAD
GetProcAddress.KERNEL32 ref: 00007FF6EB1F9AC3
FreeLibrary.KERNEL32 ref: 00007FF6EB1F9AEA

Strings

mscoree.dll, xrefs: 00007FF6EB1F9AA4
CorExitProcess, xrefs: 00007FF6EB1F9ABC

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: d0de3a61aa34bffd49ad61746d467eac2ef48503b972612450b8da12fda54620
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 25F0C222B0870681EB249B20E4A837A6320EF4D7A4F540235D66E861F4DF2FD048C309

Function 00007FF6EB209368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6EB209390
_set_statfp.LIBCMT ref: 00007FF6EB2093AB
_set_statfp.LIBCMT ref: 00007FF6EB2093C7
_set_statfp.LIBCMT ref: 00007FF6EB209403

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 5637e36e4d4152c43552848cc031a4fb031fa156a73831e6d469cc4675d80290
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 31118233E5CA0749FA6412ADE6B13791050AF9D370E040634FB6FD62F6AE6E6841470B

Function 00007FF6EB1FB390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6EB1FA5A3,?,?,00000000,00007FF6EB1FA83E,?,?,?,?,?,00007FF6EB1FA7CA), ref: 00007FF6EB1FB3AF
FlsSetValue.KERNEL32(?,?,?,00007FF6EB1FA5A3,?,?,00000000,00007FF6EB1FA83E,?,?,?,?,?,00007FF6EB1FA7CA), ref: 00007FF6EB1FB3CE
FlsSetValue.KERNEL32(?,?,?,00007FF6EB1FA5A3,?,?,00000000,00007FF6EB1FA83E,?,?,?,?,?,00007FF6EB1FA7CA), ref: 00007FF6EB1FB3F6
FlsSetValue.KERNEL32(?,?,?,00007FF6EB1FA5A3,?,?,00000000,00007FF6EB1FA83E,?,?,?,?,?,00007FF6EB1FA7CA), ref: 00007FF6EB1FB407
FlsSetValue.KERNEL32(?,?,?,00007FF6EB1FA5A3,?,?,00000000,00007FF6EB1FA83E,?,?,?,?,?,00007FF6EB1FA7CA), ref: 00007FF6EB1FB418

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
Instruction ID: e4ad4b68c43abde844bc0297cc816a3246e229006feb8cf4df45dd2dce247014
Opcode Fuzzy Hash: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
Instruction Fuzzy Hash: C3116062E0964241F958A32566413FA12525F4C7B8F688334D86EC66F6DD2FA402C20A

Function 00007FF6EB1FB224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6EB1FB235
FlsSetValue.KERNEL32 ref: 00007FF6EB1FB254
FlsSetValue.KERNEL32 ref: 00007FF6EB1FB27C
FlsSetValue.KERNEL32 ref: 00007FF6EB1FB28D
FlsSetValue.KERNEL32 ref: 00007FF6EB1FB29E

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
Instruction ID: 5ac855b78fafc6b9f8b42fb910ac64eb6ac60dff292e6577b7765b8434274e23
Opcode Fuzzy Hash: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
Instruction Fuzzy Hash: 4D112A62E0920741FA58A36159513FE12525F4D378F388734D93ECA6F2DD2FB842C24B

Function 00007FF6EB1F5FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F5FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F6106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F61BC

Strings

verbose, xrefs: 00007FF6EB1F5FB0

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: aba4fbeaaf57a2f87f047ba72ac473b4823c4f501151cb6ca280e1a4609f5490
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 2A91B323A0C64681F7618EA4D4503FD36A5AF88BE8F644235DA5D833E5DE3EE805C30A

Function 00007FF6EB1FFBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1FFEA7

Part of subcall function 00007FF6EB1F7A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F7A59

Strings

UTF-16LEUNICODE, xrefs: 00007FF6EB1FFE45
UTF-8, xrefs: 00007FF6EB1FFE26
ccs, xrefs: 00007FF6EB1FFDE2

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 2134636af18301b4860933fe90c5a3ca7fc9c5ef4c1b1d3967103309eac924d5
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 59818473D0A2C285E7749E2581503B827A1AF19B6CF754035CA8ED72A6DFAFA501D20B

Function 00007FF6EB1ED648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6EB1ED673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6EB1ED70A
RtlUnwindEx.KERNEL32 ref: 00007FF6EB1ED764

Strings

csm, xrefs: 00007FF6EB1ED6F1

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 7c29f287503c8f52f92720da64c52ce7093a9873c53eba2df07531ffebb9fbaa
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: AF519033A196028ADB148B15D044BBC7391EB48BACF159134DA5EA7BA8DF7EE841C709

Function 00007FF6EB1EF288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6EB1EF2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6EB1EF398

Strings

csm, xrefs: 00007FF6EB1EF3EA
csm, xrefs: 00007FF6EB1EF2D2

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 279ff98792e310900306c5410b05a890428683c0255e6560f7cb9694745eb999
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: C1516233618682C6EB748A2190843AC77A0EB59BA8F184135DE9D87FE5CF3DE550C70A

Function 00007FF6EB1EEED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6EB1EEF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6EB1EEF83

Strings

RCC, xrefs: 00007FF6EB1EEF53
MOC, xrefs: 00007FF6EB1EEF4B

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: c975489f541b2424f32fe6d122f4421ec99214015a6ca9cdb04ad799d628e11b
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: FB617E33918BC585E7609B15E4403EEB7A0FB89BA8F044225EA9C47B69DF7DE190CB05

Function 00007FF6EB1E2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF6EB1E28EA

Strings

Error, xrefs: 00007FF6EB1E28DD
[PYI-%d:%ls] , xrefs: 00007FF6EB1E2868
ERROR, xrefs: 00007FF6EB1E286F

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: c71c3d0cad5ccca42107cb213c7dfec70e1305e0661e7c53124548e45e85072e
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: 3A21BC73B08B4186E7209B14B8547EA63A4EF8C794F400136EA8D93A6AEF3DE245C745

Function 00007FF6EB1FC5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6EB1FC61F
WriteFile.KERNEL32 ref: 00007FF6EB1FC8E7
WriteFile.KERNEL32 ref: 00007FF6EB1FC92D
GetLastError.KERNEL32 ref: 00007FF6EB1FC9E3

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 17150d9ee486c1c626b7e9fe5523198970008705ada514ef1c218f7c87655747
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: F2D1F273B18A8189E710CF65D4402EC37B1FB587A8B644236DE5ED7BA9DE3AD006C709

Function 00007FF6EB1E20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6EB1E20F4
SetWindowLongPtrW.USER32 ref: 00007FF6EB1E2116
GetWindowLongPtrW.USER32 ref: 00007FF6EB1E2140
InvalidateRect.USER32 ref: 00007FF6EB1E2160

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 2525cf240d1c9e378ec339362fdca3816b8419857ca4595159afb20c7a770568
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 0611E923B0C14282F6548B6AE5683FD5351EF8C794F484030EB4987FA9DD2FD6D1824B

Function 00007FF6EB205B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EB201760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB201793

_get_daylight.LIBCMT ref: 00007FF6EB205C34
_get_daylight.LIBCMT ref: 00007FF6EB205C45

Strings

?, xrefs: 00007FF6EB205BC5

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: 32b8518b3b6e5f33e5ef280ec39b1f5b4f7739d966b5fe2385b3eae47682a6d1
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: CD413C13A1868249F7608735D6A137D67A0EF88BA4F144235EE5C87AF9EF3ED441C705

Function 00007FF6EB1F9014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F9046

Part of subcall function 00007FF6EB1FA948: RtlFreeHeap.NTDLL(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA95E
Part of subcall function 00007FF6EB1FA948: GetLastError.KERNEL32(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6EB1ECBA5), ref: 00007FF6EB1F9064

Strings

C:\Users\user\Desktop\FluxusV2.exe, xrefs: 00007FF6EB1F9052

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\FluxusV2.exe
API String ID: 3580290477-2238568748
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: dc94c81d2a0e2b80741b77899213e2170300a4cce5e2624362a41b564bc90ff1
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: 5F41A133A18A0285EB15EF25A9402FC23A5EF487E8B694035ED4DC7BA5DE3EE481C345

Function 00007FF6EB1FCC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6EB1FCD4F
GetLastError.KERNEL32 ref: 00007FF6EB1FCD71

Strings

U, xrefs: 00007FF6EB1FCCFB

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 030b9d2f2be1f6132f2dd4d2cb400f7752b0a0abc5a9466c96347e190d985c09
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: C641C023A18A8185EB208F25E8443FA67A4FB88798F544031EA4DC7BA8EF3ED401D745

Function 00007FF6EB1FF5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6EB1FF5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6EB1FF64A

Strings

:, xrefs: 00007FF6EB1FF60E

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
Instruction ID: 6f8fec0d69a1cf020cd6cb2b6105af6ca63065f50e6455f6594b0a20ef8c13cc
Opcode Fuzzy Hash: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
Instruction Fuzzy Hash: BB21D563A1828181EB20DB15D4543BD63A1FF8CB68F958035DA8D836A4DFBEE544C746

Function 00007FF6EB1EFD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6EB1EFD98
RaiseException.KERNEL32 ref: 00007FF6EB1EFDD9

Strings

csm, xrefs: 00007FF6EB1EFDC6

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 11601f615bbc9cd63685f57987462fce6c6fc2359088e258884b05efac8f0b10
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: EC113A33618B8582EB218F15E4142A9BBA4FB88B98F184230DECD87B64DF3DC5518704

Function 00007FF6EB20073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB20076C
GetDriveTypeW.KERNEL32 ref: 00007FF6EB2007AC

Strings

:, xrefs: 00007FF6EB200795

Memory Dump Source

Source File: 00000000.00000002.3450120697.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000000.00000002.3450078417.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450157004.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450206478.00007FF6EB222000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3450270364.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: c972ef0195df6b23c383249d2f251ec6c563fcb8c5fde18b462b69bde01858fd
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 49017C23A182078AF730AB6095753BE62A0EF4C758F940035D64DC66B1EE2EE504CB1E

Analysis Process: FluxusV2.exePID: 6656, Parent PID: 1396COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	882
Total number of Limit Nodes:	45

Executed Functions

Function 00007FF6EB1E1000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6EB1E3B32
Failed to start splash screen!, xrefs: 00007FF6EB1E3ECC
VCRUNTIME140.dll, xrefs: 00007FF6EB1E3DA9
MEI, xrefs: 00007FF6EB1E3933
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6EB1E3C61
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6EB1E3882, 00007FF6EB1E38AF
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6EB1E3A0B, 00007FF6EB1E3CD4, 00007FF6EB1E3F63
Failed to convert DLL search path!, xrefs: 00007FF6EB1E3DD4
Failed to load splash screen resources!, xrefs: 00007FF6EB1E3E7D
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6EB1E3E9E
pyi-runtime-tmpdir, xrefs: 00007FF6EB1E3B68
pyi-python-flag, xrefs: 00007FF6EB1E3AD6
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6EB1E3EB3
Could not create temporary directory!, xrefs: 00007FF6EB1E3CBF
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6EB1E3D35
pkg, xrefs: 00007FF6EB1E39BE
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6EB1E3971
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6EB1E3BE8
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6EB1E3A17, 00007FF6EB1E3A2F, 00007FF6EB1E3A9B
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6EB1E39DE
Py_GIL_DISABLED, xrefs: 00007FF6EB1E3AF4
Failed to remove temporary directory: %s, xrefs: 00007FF6EB1E3FC7
pyi-disable-windowed-traceback, xrefs: 00007FF6EB1E3BB2
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6EB1E3D12
pyi-contents-directory, xrefs: 00007FF6EB1E3B8D
_PYI_ARCHIVE_FILE, xrefs: 00007FF6EB1E38D2, 00007FF6EB1E39FF
_PYI_SPLASH_IPC, xrefs: 00007FF6EB1E3A23, 00007FF6EB1E3EED
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6EB1E3E02

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 0fbc70c4027613d0d861555d20556e9b1b6679d528821aa3e7ef290c14fd0fef
Instruction ID: 52655b5aee18f4673c4f84956a500d28b35f3728e4250cc62bd74e59050f982b
Opcode Fuzzy Hash: 0fbc70c4027613d0d861555d20556e9b1b6679d528821aa3e7ef290c14fd0fef
Instruction Fuzzy Hash: 33328223E0C68255FB16D725A6643FD6251AF4C7A8F844032DA4DC3AF6EF2EE554C30A

Function 00007FFD93B21992 Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B3D32F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3D347
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3D357
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B3D381
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3D399
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3D3AA
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B3D3AF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3D3C7
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3D3D8
CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFD93B3D411
CRYPTO_THREAD_lock_new.LIBCRYPTO-3 ref: 00007FFD93B3D428
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B3D439
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3D451
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3D462
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B3D477
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD93B3D499
OPENSSL_LH_new.LIBCRYPTO-3 ref: 00007FFD93B3D510
X509_STORE_new.LIBCRYPTO-3 ref: 00007FFD93B3D522
CTLOG_STORE_new_ex.LIBCRYPTO-3 ref: 00007FFD93B3D53A
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93B3D5CE
X509_VERIFY_PARAM_new.LIBCRYPTO-3 ref: 00007FFD93B3D5DB
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD93B3D61E
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD93B3D633
CRYPTO_new_ex_data.LIBCRYPTO-3 ref: 00007FFD93B3D657
CRYPTO_secure_zalloc.LIBCRYPTO-3 ref: 00007FFD93B3D676
RAND_bytes_ex.LIBCRYPTO-3 ref: 00007FFD93B3D6CB
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FFD93B3D6E5
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FFD93B3D703
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FFD93B3D728
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B3D786
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3D79E

Strings

SSL_CTX_new_ex, xrefs: 00007FFD93B3D334, 00007FFD93B3D386, 00007FFD93B3D3B4, 00007FFD93B3D43E, 00007FFD93B3D78B
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B3D340, 00007FFD93B3D392, 00007FFD93B3D3C0, 00007FFD93B3D405, 00007FFD93B3D44A, 00007FFD93B3D46D, 00007FFD93B3D48F, 00007FFD93B3D66A, 00007FFD93B3D797

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$R_set_error$D_priv_bytes_ex$L_sk_new_nullX509_$D_bytes_exD_lock_newE_newE_new_exH_newL_sk_numM_newO_freeO_new_ex_dataO_secure_zallocO_strdupO_zalloc
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_new_ex
API String ID: 864562269-27091654
Opcode ID: 0ef21fb0b24aa75d52d15136eef25518695f37dfed3ffb2822b27bc7d2223680
Instruction ID: ead60522101252ae91189f580ab9db1b070c525c7101eb9f941e57478fa90b8d
Opcode Fuzzy Hash: 0ef21fb0b24aa75d52d15136eef25518695f37dfed3ffb2822b27bc7d2223680
Instruction Fuzzy Hash: A6C15A65B19B5281FB64ABA1E4717F92299AF4478CF440139DE8D6A7C6DF3CE900C311

Function 00007FF6EB205C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6EB205C45

Part of subcall function 00007FF6EB205598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2055AC

Part of subcall function 00007FF6EB1FA948: HeapFree.KERNEL32(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA95E
Part of subcall function 00007FF6EB1FA948: GetLastError.KERNEL32(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA968

Part of subcall function 00007FF6EB1FA900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6EB1FA8DF,?,?,?,?,?,00007FF6EB1FA7CA), ref: 00007FF6EB1FA909
Part of subcall function 00007FF6EB1FA900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6EB1FA8DF,?,?,?,?,?,00007FF6EB1FA7CA), ref: 00007FF6EB1FA92E

_get_daylight.LIBCMT ref: 00007FF6EB205C34

Part of subcall function 00007FF6EB2055F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB20560C

_get_daylight.LIBCMT ref: 00007FF6EB205EAA
_get_daylight.LIBCMT ref: 00007FF6EB205EBB
_get_daylight.LIBCMT ref: 00007FF6EB205ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6EB20610C), ref: 00007FF6EB205EF3

Strings

Eastern Standard Time, xrefs: 00007FF6EB205F99
Eastern Summer Time, xrefs: 00007FF6EB205FB1

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction ID: 1017775de043f2d3c46aba312a8ab0018fc9ff29771313304c87bc7df8bf7b68
Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction Fuzzy Hash: F0D1D527A182424EE7209F31DAA03B96761FF8C794F448135EA4DC76A5EF3EE441C74A

Function 00007FF6EB206964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6EB206698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2066D9
Part of subcall function 00007FF6EB206698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB206757
Part of subcall function 00007FF6EB206698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2067A8

CreateFileW.KERNEL32 ref: 00007FF6EB206A6A
CreateFileW.KERNEL32 ref: 00007FF6EB206ABA
GetLastError.KERNEL32 ref: 00007FF6EB206AEA
GetFileType.KERNEL32 ref: 00007FF6EB206AFF
GetLastError.KERNEL32 ref: 00007FF6EB206B09
CloseHandle.KERNEL32 ref: 00007FF6EB206B3C
CloseHandle.KERNEL32 ref: 00007FF6EB206C9F
CreateFileW.KERNEL32 ref: 00007FF6EB206CD4
GetLastError.KERNEL32 ref: 00007FF6EB206CE3

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 1d18905feefc2876fd96d53137f2cd7e307ec7eaf88f656df72c6858235c65da
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 61C1BF33B28A4589EB11CFA9C5A03BC3761EB4DBA8F114235DA1E9B7A4DF3AD051D305

Function 00007FF6EB205E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6EB205EAA

Part of subcall function 00007FF6EB2055F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB20560C

_get_daylight.LIBCMT ref: 00007FF6EB205EBB

Part of subcall function 00007FF6EB205598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2055AC

_get_daylight.LIBCMT ref: 00007FF6EB205ECC

Part of subcall function 00007FF6EB2055C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB2055DC

Part of subcall function 00007FF6EB1FA948: HeapFree.KERNEL32(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA95E
Part of subcall function 00007FF6EB1FA948: GetLastError.KERNEL32(?,?,?,00007FF6EB202D22,?,?,?,00007FF6EB202D5F,?,?,00000000,00007FF6EB203225,?,?,?,00007FF6EB203157), ref: 00007FF6EB1FA968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6EB20610C), ref: 00007FF6EB205EF3

Strings

Eastern Standard Time, xrefs: 00007FF6EB205F99
Eastern Summer Time, xrefs: 00007FF6EB205FB1

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction ID: fef302e48c1cd792944211e73645b005b807e3dc053ca995c02c30257e5353ec
Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction Fuzzy Hash: 57517F23A186428EE710DF31EA956B96761FF4C784F448136EA4DC76B5EF3EE400874A

Function 00007FF6EB1E9280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6EB1E92B3
FindClose.KERNEL32 ref: 00007FF6EB1E92C2

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: ec47a33d0b11cdcad2822813de8fa2dfccb8b407b2d3daf6182ebcfe24391970
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 30F04433A1874286FB608B64B5997BA7350AF88778F040235E96D42AE4DF3DD0598B09

Function 00007FFD938911E0 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD93891205

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7e95180d38cd00ed8df76aa16efa4cdac9e9adb77db5b2022ed37012a1f49ff9
Instruction ID: 1961b10fa5c6f4100fffb48ffb9b78353d8684ce47f895ed45564d4a0ac6ba53
Opcode Fuzzy Hash: 7e95180d38cd00ed8df76aa16efa4cdac9e9adb77db5b2022ed37012a1f49ff9
Instruction Fuzzy Hash: 7DA10465F0EB0795FE74CBD5A87037927A9BF48B80F540539C90E7A7A0DF2DAA918300

Function 00007FFD93B214F1 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FFD93B6779F
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B6783B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B67853
SetLastError.KERNEL32 ref: 00007FFD93B678A2
BIO_read.LIBCRYPTO-3 ref: 00007FFD93B678C9
BIO_test_flags.LIBCRYPTO-3 ref: 00007FFD93B678EA
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD93B67900
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B67958
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B67970
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B679C0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B679D8

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFD93B6784C, 00007FFD93B67969, 00007FFD93B679D1
ssl3_read_n, xrefs: 00007FFD93B67840, 00007FFD93B6795D, 00007FFD93B679C5

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$ErrorLastO_ctrlO_readO_test_flagsmemmove
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_read_n
API String ID: 3874383451-4226281315
Opcode ID: 3ca2100bb6b87b098cae2558db268160d918adefb8b476431aa8d90b6f162e8a
Instruction ID: 1961be5d1038832abfcef03cb1a775d925d4438a24c9981f354a9be3304dad9e
Opcode Fuzzy Hash: 3ca2100bb6b87b098cae2558db268160d918adefb8b476431aa8d90b6f162e8a
Instruction Fuzzy Hash: 0B919F32B0869282FB60DFA5D4657B932A8EF44BACF544231DE8C27A96EF38D455C340

Function 00007FF6EB1E1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6EB1E7F90: _fread_nolock.LIBCMT ref: 00007FF6EB1E803A

_fread_nolock.LIBCMT ref: 00007FF6EB1E1A1B

Part of subcall function 00007FF6EB1E2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6EB1E1B6A), ref: 00007FF6EB1E295E

Strings

malloc, xrefs: 00007FF6EB1E1B22
MEI, xrefs: 00007FF6EB1E1991
fread, xrefs: 00007FF6EB1E1A32, 00007FF6EB1E1B5C
Error on file., xrefs: 00007FF6EB1E1B8D
fseek, xrefs: 00007FF6EB1E19F5
Could not allocate memory for archive structure!, xrefs: 00007FF6EB1E1A61
Failed to read cookie!, xrefs: 00007FF6EB1E1A2B
Failed to seek to cookie position!, xrefs: 00007FF6EB1E19EE
calloc, xrefs: 00007FF6EB1E1A68
Could not read full TOC!, xrefs: 00007FF6EB1E1B55
Could not allocate buffer for TOC!, xrefs: 00007FF6EB1E1B1B

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 6a04d0c4c8a0b99f23b16d6d676f1581d6c74e17851155a383b4fbd0f348e88e
Instruction ID: 8fa599a7ff0a601d252d02d511ac17926e67537b135acf86eb5bf9755e40bec8
Opcode Fuzzy Hash: 6a04d0c4c8a0b99f23b16d6d676f1581d6c74e17851155a383b4fbd0f348e88e
Instruction Fuzzy Hash: A581B173A086868AEB20DB24D0643FD23A0EF4C798F504435DA8DC7BA5DE3EE555874B

Function 00007FFD93B7E240 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFD93B7E4D4, 00007FFD93B7E511, 00007FFD93B7E53E, 00007FFD93B7E5B1
read_state_machine, xrefs: 00007FFD93B7E4CD, 00007FFD93B7E50A, 00007FFD93B7E532, 00007FFD93B7E5A5

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c$read_state_machine
API String ID: 0-3323778802
Opcode ID: 14377edc59a60446f09f780bfe0d0aa6ceb5de1d18d0f26ea132c90706a724b0
Instruction ID: f66b2bc8a2acbc26f3e9ffda0cbf2a712179f591ab36f1b1829a542bc6f95669
Opcode Fuzzy Hash: 14377edc59a60446f09f780bfe0d0aa6ceb5de1d18d0f26ea132c90706a724b0
Instruction Fuzzy Hash: A8919E72B0864A85FB30DFA5D4603B927A9EF80B8CF544136DA8E67A95DF3CE546C300

Function 00007FF6EB1E2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 00007FF6EB1E21AB
SelectObject.GDI32 ref: 00007FF6EB1E21F2
DrawTextW.USER32 ref: 00007FF6EB1E2215
SelectObject.GDI32 ref: 00007FF6EB1E222B
ReleaseDC.USER32 ref: 00007FF6EB1E223B
MoveWindow.USER32 ref: 00007FF6EB1E228B
MoveWindow.USER32 ref: 00007FF6EB1E22CB
MoveWindow.USER32 ref: 00007FF6EB1E231E
MoveWindow.USER32 ref: 00007FF6EB1E2366

Strings

P%, xrefs: 00007FF6EB1E21FF

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 7e1b032e8f912ceb1c9096b761dca54b5f05094b9a725fcd86fd722a725ced48
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: A25108266047A186D6349F36E4282BAB7A1FB9CB65F004121EFDE83694EF3DD045DB14

Function 00007FFD93B7EC70 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3(?,?,?,-00000031,00007FFD93B7E9C6), ref: 00007FFD93B7ED22
ERR_set_debug.LIBCRYPTO-3(?,?,?,-00000031,00007FFD93B7E9C6), ref: 00007FFD93B7ED3A

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFD93B7ED33, 00007FFD93B7F022
write_state_machine, xrefs: 00007FFD93B7ED2C, 00007FFD93B7F01B

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem.c$write_state_machine
API String ID: 193678381-552286378
Opcode ID: 1edee16b17f7b7a209ddbeed6cd636bdd8764bdbe6572802cc707b3b873bb90e
Instruction ID: ebd0996e1a09b3b68ea99ceed69a9cd6a459931e4da04ff425d292f979cb764c
Opcode Fuzzy Hash: 1edee16b17f7b7a209ddbeed6cd636bdd8764bdbe6572802cc707b3b873bb90e
Instruction Fuzzy Hash: 1DA18E32B0864685EB749FA5D4743B923A8FF40B8CF444136DA8E67AA5DF3CE946C700

Function 00007FF6EB1E1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF6EB1E151F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6EB1E149F
fread, xrefs: 00007FF6EB1E15E6
fseek, xrefs: 00007FF6EB1E14E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6EB1E14DE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6EB1E15DF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6EB1E1518

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 60a4f7716322392174b45f0900a3bf04e5f00cb62b5f775a2b3fa26e9f7385d7
Instruction ID: 07115cb0ff7975b6382aad05fb4a6e47fc2d0182e42044d24344e4875a9d7808
Opcode Fuzzy Hash: 60a4f7716322392174b45f0900a3bf04e5f00cb62b5f775a2b3fa26e9f7385d7
Instruction Fuzzy Hash: 9A418123A0864285EB10DB2195107F96390FF4D7A8F944532ED0D87BB9DE3EE551CB0B

Function 00007FF6EB1E1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF6EB1E12C1, 00007FF6EB1E12F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6EB1E141E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6EB1E12BA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6EB1E12EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6EB1E1276
1.3.1, xrefs: 00007FF6EB1E1249

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 096f828560730c5e91f8963ea1229aecabbed89a92b0e893cc7cf6d4f043b132
Instruction ID: 10f61c84e958e37e1d71b456dfb13cc63a6b23abc04c5bbd75ffdcc28d2ca320
Opcode Fuzzy Hash: 096f828560730c5e91f8963ea1229aecabbed89a92b0e893cc7cf6d4f043b132
Instruction Fuzzy Hash: EF51C023A0864285EA20AB15A4503FE6291FF887A8F944135ED4DC7BF5EF3EE541C70A

Function 00007FF6EB1E36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6EB1E3804), ref: 00007FF6EB1E36E1
GetLastError.KERNEL32(?,00007FF6EB1E3804), ref: 00007FF6EB1E36EB

Part of subcall function 00007FF6EB1E2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EB1E3706,?,00007FF6EB1E3804), ref: 00007FF6EB1E2C9E
Part of subcall function 00007FF6EB1E2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EB1E3706,?,00007FF6EB1E3804), ref: 00007FF6EB1E2D63
Part of subcall function 00007FF6EB1E2C50: MessageBoxW.USER32 ref: 00007FF6EB1E2D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF6EB1E3739
Failed to obtain executable path., xrefs: 00007FF6EB1E36F3
\\?\, xrefs: 00007FF6EB1E375A
Failed to convert executable path to UTF-8., xrefs: 00007FF6EB1E3790
GetModuleFileNameW, xrefs: 00007FF6EB1E36FA

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 09a6c5356a01b22de160a69859b445b4150499de5f9fc8778fef8e1db76f3cb4
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: F52174A3F1C64245FA219720E9643FA22A1BF8C3A8F404131D55DC69F5FE2EE505C34A

Function 00007FF6EB1FBA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1FBE89

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction ID: 5d462d0b13698e6d5b6ff251167745ceea039769ff6d1662fbf602f1b5ee3c7b
Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction Fuzzy Hash: B0C1D223A1C68681E7609B1590403FE2B51EF89BA8F754131EA4E877B6CE7EE445C70B

Function 00007FFD93B90710 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B90836
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9084E
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B908CE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B908E6

Strings

tls_get_message_header, xrefs: 00007FFD93B9083B, 00007FFD93B908D3
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93B90847, 00007FFD93B908DF

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_get_message_header
API String ID: 193678381-2714770296
Opcode ID: 0a675c68133e8178ac648a78a03b7d1437f40432096ecb796daf1537fba5ad51
Instruction ID: 319b54a4c81d07fe834cbb35cb89b6bc1e574086be16fbfc607cb2269b183259
Opcode Fuzzy Hash: 0a675c68133e8178ac648a78a03b7d1437f40432096ecb796daf1537fba5ad51
Instruction Fuzzy Hash: 87613C32B0868286EBA0CF65E4643A937A8FB45B4CF088036DACD67795DF3CD555C710

Function 00007FF6EB1E6360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

LoadLibrary, xrefs: 00007FF6EB1E64AE
Failed to load Python DLL '%ls'., xrefs: 00007FF6EB1E64A7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6EB1E6407
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6EB1E6456
ucrtbase.dll, xrefs: 00007FF6EB1E63DD
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6EB1E63C7

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: c09c5ca4b44f5ac09c2c6f2e1c89924df1c26c48483e95282415f98aa7d90b4f
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: 15418473A1868691EA15DB20E5243FD6351FF5C3A8F900132DA5C83AB9EF3DE505C746

Function 00007FFD93B3FAE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B3FB00
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3FB18
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3FB28
ASYNC_get_current_job.LIBCRYPTO-3 ref: 00007FFD93B3FB75

Strings

SSL_do_handshake, xrefs: 00007FFD93B3FB05
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B3FB11

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_do_handshake
API String ID: 2134390360-2964568172
Opcode ID: c91630741219631a69d9c5f3432363629406958cc77146902cc34db31b5e4eda
Instruction ID: f8a2082ddb58971643e1c33f9d3d9b740065c6ac2eb562e568c6453925d3ec20
Opcode Fuzzy Hash: c91630741219631a69d9c5f3432363629406958cc77146902cc34db31b5e4eda
Instruction Fuzzy Hash: 0121C773F0874242EA60DBB5E4612BD2359EF8878CF580231EADD26786DF3CE5418600

Function 00007FF6EB1E2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6EB1E23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF6EB1E248E
DeleteObject.GDI32 ref: 00007FF6EB1E24C1
DestroyIcon.USER32 ref: 00007FF6EB1E24D3

Strings

Unhandled exception in script, xrefs: 00007FF6EB1E23F8

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: e703c722d5ae4059f0211456f13f825b4807100a09f6709d6b183593c2794b09
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: AD319073619A8289EB20DB21E8653F96360FF8C798F440135EA4D87B69DF3DD104C706

Function 00007FF6EB1FF98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6EB1FFA7C
_get_daylight.LIBCMT ref: 00007FF6EB1FFA8D
_get_daylight.LIBCMT ref: 00007FF6EB1FFA9E
_isindst.LIBCMT ref: 00007FF6EB1FFB69

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 7d22d7840cf66a30ce78a1cc8188753238daab9f3959b62b33a556a0aecab2aa
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 9251F173F052528AEB14CB6499A17FC27A5AF583ACF240235DD1E92AF5DF3EA402C705

Function 00007FF6EB1F577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6EB1F57AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF6EB1F5811
GetLastError.KERNEL32 ref: 00007FF6EB1F58A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EB1F56B4), ref: 00007FF6EB1F58EE

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
Instruction ID: cd60373d8a0508a68cbaca068b1048803176c1e9a72c92e0bfb750041f7bbc41
Opcode Fuzzy Hash: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
Instruction Fuzzy Hash: CD515923E186418AFB24CF6194503BD27A1BF48BACF248534DA0D9A6A9DF3AD441C706

Function 00007FF6EB1F5628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F5655
CreateFileW.KERNEL32 ref: 00007FF6EB1F5694
CloseHandle.KERNEL32 ref: 00007FF6EB1F56C9

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: a37e3e2e2766edd3382710247e31d8ce99e2041bf53b8dcfd1aee661b64531d8
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: 66419223D2878283E7108B6095143B96760FF983B8F208335E6AC43AE5EF6DA1E0C745

Function 00007FF6EB1E20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6EB1E20F4
SetWindowLongPtrW.USER32 ref: 00007FF6EB1E2116
GetWindowLongPtrW.USER32 ref: 00007FF6EB1E2140
InvalidateRect.USER32 ref: 00007FF6EB1E2160

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 2525cf240d1c9e378ec339362fdca3816b8419857ca4595159afb20c7a770568
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 0611E923B0C14282F6548B6AE5683FD5351EF8C794F484030EB4987FA9DD2FD6D1824B

Function 00007FFD93B474A0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

ERR_set_mark.LIBCRYPTO-3 ref: 00007FFD93B474CC
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FFD93B474D3
EVP_CIPHER_fetch.LIBCRYPTO-3 ref: 00007FFD93B474E1
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFD93B474E9

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: J_nid2snR_fetchR_pop_to_markR_set_mark
String ID:
API String ID: 2772354928-0
Opcode ID: 9d6a64450acf58a63a50e4c19100a97fdf4d2fc7c8484d09c1bb12015f6b24b3
Instruction ID: 2cbddc8dd578af41ef41b20404b05e88eb98850906a38f8c618e7641c058a447
Opcode Fuzzy Hash: 9d6a64450acf58a63a50e4c19100a97fdf4d2fc7c8484d09c1bb12015f6b24b3
Instruction Fuzzy Hash: 94F0A005B0978141EA64A7A2E8621B995499F99BCCF084434FEDE67BDBDE2CE9414700

Function 00007FF6EB1ECC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EB1ECE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6EB1ECE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6EB1ECC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF6EB1ECCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6EB1ECD21

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: db45dfa5c9229f0091b026b3830b0ceb1360a752688e84d76dc5802a0a10f73f
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 18311D23E0824745FA24AB6599253FD1682AF497ACF545434E90DC7AF3DE2FB504C34B

Function 00007FF6EB1F013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F0180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F0277

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: d9e1f1a9e81177000935f6bbd43051899c0de0a57a22996679520af436acd554
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: E451EB63B0D24386EB249E2594047FA6691AF4CBBCF284738DD6D837E5CE3ED501C60A

Function 00007FF6EB1FC134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF6EB1FC2CD), ref: 00007FF6EB1FC180
GetLastError.KERNEL32(?,?,?,?,?,00007FF6EB1FC2CD), ref: 00007FF6EB1FC18A

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: ce20b5d7bac61ad7d74c820c0fb7832c750cbfb44bdc34a320e4902043ac7e12
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: CE11046360CA81C1DA208B25B8142A96361AF49FF8F640331EE7D8BBF9CE3ED010C705

Function 00007FF6EB1F5924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EB1F5839), ref: 00007FF6EB1F5957
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6EB1F5839), ref: 00007FF6EB1F596D

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: e4b72f3f4ee909edf4403ca1acef619aa82077817100dad9eb577dc0a7a799df
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 1F11913360C74282EB688B14A4113BAB760FF89775F601236F69DC19E8EF6ED014DB05

Function 00007FF6EB1FAB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF6EB1FA9D5,?,?,00000000,00007FF6EB1FAA8A), ref: 00007FF6EB1FABC6
GetLastError.KERNEL32(?,?,?,00007FF6EB1FA9D5,?,?,00000000,00007FF6EB1FAA8A), ref: 00007FF6EB1FABD0

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 82e0e1738056d54c91051a59a554d3f1d3055a11a84f74e20703914816e2d280
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 04219222B2868241FEA0575195943F916929F8C7F8F2C4239DA2EC77F1CE6EA441C34A

Function 00007FF6EB1FBEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1FBED4

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 9e622c635b4f1bdfa803b08b20902269ebb49dcffe5c7b9c82d72ec6a00be5d4
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 8C41C33391864187EA34CB19E5503BA77A0EF5D7A8F240131D68EC36E1CF2EE402CB56

Function 00007FF6EB1E7F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6EB1E803A

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: c6682db64852707600c43fb891f4de48ebc266699440c3858ac7b9af290251f5
Instruction ID: 076ddb4e5924e035e9b25df433b13cd12a24f093c1448709341160ee743ed01f
Opcode Fuzzy Hash: c6682db64852707600c43fb891f4de48ebc266699440c3858ac7b9af290251f5
Instruction Fuzzy Hash: 0E218722B1965246EB519A1265043FE9651BF49BE8F9C4430EE0D87B96DE7EF041C309

Function 00007FF6EB1FB93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1FB9C2

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: 2e9b655ee355e279506a71a13d5ee9f22015a73e471744b066f97627dd9adc5c
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 2C316063E2860285F7216B5598413FD2690BF88BB8F620135E91D873F2CE7EA441C71B

Function 00007FF6EB1F5F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F5EF9

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 29034f590e19cc3173e7bd4038dfc92d5137371ed628435be27a501851862e01
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: FF119923A2C64141EA609F1594003FDA660BF89BA8F654431EE8CD7AB6CF7ED400C74A

Function 00007FF6EB206354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB206377

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 9a632df24b797fba0e1ca3392089f328358987b25e68523c5bc5e19a6e470015
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 67219233A18A428AEB628F58D5503B976A0FF88F54F244234E65DC76E9EF3ED401DB05

Function 00007FF6EB1F03BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6EB1F0410

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 6d1ee569445ca7d36f3a9bbbad2117b5a991ba777caca9cc5ad88aca974f6ba5
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 6201A522B1874280E904DF5259052E9A691BF89FF4F684635DE6C93BF6DE3DD401C309

Function 00007FF6EB1E8E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EB1E9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6EB1E45F4,00000000,00007FF6EB1E1985), ref: 00007FF6EB1E93C9

LoadLibraryExW.KERNEL32(?,00007FF6EB1E6476,?,00007FF6EB1E336E), ref: 00007FF6EB1E8EA2

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: e93862936f5bb39d8f98ee17242d8f0c7d50a739e5468472c73c64c40d6e006c
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: ADD0C212F3424542EA54A77BBA567795252AFCDBC4F98C035EE1D43B6AEC3EC0414B04

Function 00007FF6EB1FD5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6EB1F0C90,?,?,?,00007FF6EB1F22FA,?,?,?,?,?,00007FF6EB1F3AE9), ref: 00007FF6EB1FD63A

Memory Dump Source

Source File: 00000002.00000002.3455164434.00007FF6EB1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EB1E0000, based on PE: true

Associated: 00000002.00000002.3455143102.00007FF6EB1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455192624.00007FF6EB20B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB21E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455218453.00007FF6EB221000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3455269435.00007FF6EB224000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6eb1e0000_FluxusV2.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 2e2df96420a23d757e733bbeb609d9e5dd49221e67ab23c0d0314e4da5725812
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 60F05E12B1820384FE6427B159113F411914F8D7B8F284730DC2ED62F1ED2FA480C21A

Non-executed Functions

Function 00007FFD93B97820 Relevance: 118.0, APIs: 63, Strings: 4, Instructions: 767COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97888
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B978A0
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B9797E
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97996
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B979AB
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B979C3
OPENSSL_sk_free.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97C8D
OPENSSL_sk_free.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97C96
CRYPTO_free.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97CAF
CRYPTO_free.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97CC8
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97CE5
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97CFD
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97D0D
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97D25
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B97D57
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B97D6F
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97E50
OPENSSL_sk_num.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97EAA
OPENSSL_sk_value.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97EB9
OPENSSL_sk_num.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97ECA
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97ED3
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97EEB
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97F27
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B98D5C), ref: 00007FFD93B97F3F
CRYPTO_memcmp.LIBCRYPTO-3 ref: 00007FFD93B9805B
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B980BF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B980D7
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B981EF
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD93B9821A
OPENSSL_sk_dup.LIBCRYPTO-3 ref: 00007FFD93B98226
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD93B98239
OPENSSL_sk_dup.LIBCRYPTO-3 ref: 00007FFD93B98245
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B98287
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9829F
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B982D7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B982EF
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93B98310
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93B98330
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93B9834D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B98368
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B98380
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B983C3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B983DB
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93B9841C
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93B98440
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD93B984B1
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B984C6
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD93B98517
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD93B98520
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B98539
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B98552

Strings

@, xrefs: 00007FFD93B97F54
P, xrefs: 00007FFD93B9784F
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93B97899, 00007FFD93B9798F, 00007FFD93B979BC, 00007FFD93B97A35, 00007FFD93B97AA8, 00007FFD93B97C67, 00007FFD93B97CA2, 00007FFD93B97CBB, 00007FFD93B97CF6, 00007FFD93B97D1E, 00007FFD93B97D68, 00007FFD93B97EE4, 00007FFD93B97F38, 00007FFD93B980D0, 00007FFD93B98298, 00007FFD93B982E8, 00007FFD93B98379, 00007FFD93B983D4, 00007FFD93B9852C, 00007FFD93B98545
tls_early_post_process_client_hello, xrefs: 00007FFD93B9788D, 00007FFD93B97983, 00007FFD93B979B0, 00007FFD93B97A2E, 00007FFD93B97AA1, 00007FFD93B97C5B, 00007FFD93B97CEA, 00007FFD93B97D12, 00007FFD93B97D5C, 00007FFD93B97ED8, 00007FFD93B97F2C, 00007FFD93B980C9, 00007FFD93B981F4, 00007FFD93B9828C, 00007FFD93B982DC, 00007FFD93B9836D, 00007FFD93B983C8

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_new$R_set_debug$L_sk_free$L_sk_num$O_free$L_sk_value$L_sk_dup$O_memcmpmemcpy
String ID: ..\s\ssl\statem\statem_srvr.c$@$P$tls_early_post_process_client_hello
API String ID: 3172855559-1173447675
Opcode ID: f4ebc71df91df51bf9ae05e26b6cd4839ddc4547f31832c535cc23f7216b7177
Instruction ID: 7697df843c38fbbd23d80c98a92df8fd65d3d3147a04df5b416fbd08b7bb4e4f
Opcode Fuzzy Hash: f4ebc71df91df51bf9ae05e26b6cd4839ddc4547f31832c535cc23f7216b7177
Instruction Fuzzy Hash: 7F728162B0868285FB349BA1D4713B923A9EF84B8CF544135DE8DAB795CF3DE981C340

Function 00007FFD93B4B700 Relevance: 79.0, APIs: 43, Strings: 2, Instructions: 248COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B765
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B77D
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B78B
OPENSSL_sk_num.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B7AB
OPENSSL_sk_value.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B7B9
OPENSSL_sk_num.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B7E5
X509_get_pubkey.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B7F9
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B82F
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B847
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B858
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B862
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B87A
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B889
EVP_PKEY_missing_parameters.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B896
EVP_PKEY_missing_parameters.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B8A2
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B8AB
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B8C3
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B8D4
EVP_PKEY_copy_parameters.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B8E4
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B8ED
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B905
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B916
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B97F
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B997
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4B9A8
EVP_PKEY_free.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B4A9C7), ref: 00007FFD93B4BB18

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFD93B4B776, 00007FFD93B4B840, 00007FFD93B4B873, 00007FFD93B4B8BC, 00007FFD93B4B8FE, 00007FFD93B4B949, 00007FFD93B4B990, 00007FFD93B4B9F3, 00007FFD93B4BA3D
ssl_set_cert_and_key, xrefs: 00007FFD93B4B76A, 00007FFD93B4B834, 00007FFD93B4B867, 00007FFD93B4B8B0, 00007FFD93B4B8F2, 00007FFD93B4B93D, 00007FFD93B4B984, 00007FFD93B4B9E7, 00007FFD93B4BA31

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$L_sk_numY_missing_parameters$L_sk_valueX509_get_pubkeyY_copy_parametersY_free
String ID: ..\s\ssl\ssl_rsa.c$ssl_set_cert_and_key
API String ID: 1144767644-2212061476
Opcode ID: 718aa228bd25fbf1d3cfbf5b674043b17c9deff214c523a0100d0522540fc82e
Instruction ID: 4d074600b702ab318fa71fba754770cd5f18a3b2dfea515a800b4329c0b604ad
Opcode Fuzzy Hash: 718aa228bd25fbf1d3cfbf5b674043b17c9deff214c523a0100d0522540fc82e
Instruction Fuzzy Hash: DBB14E25B0C65652EA70EBA1E4B16BD2368EF9478CF500031EACE637E6DE3CE505C705

Function 00007FFD93B21846 Relevance: 77.4, APIs: 42, Strings: 2, Instructions: 435COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD93B9AA0E
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B9AA1F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9AA37
X509_new_ex.LIBCRYPTO-3 ref: 00007FFD93B9ABAF
d2i_X509.LIBCRYPTO-3 ref: 00007FFD93B9ABCC
X509_free.LIBCRYPTO-3 ref: 00007FFD93B9AE62
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93B9AE71

Strings

tls_process_client_certificate, xrefs: 00007FFD93B9AA24, 00007FFD93B9ACF5, 00007FFD93B9AD7B, 00007FFD93B9ADC3, 00007FFD93B9ADE8, 00007FFD93B9AE1F, 00007FFD93B9AE8C, 00007FFD93B9AEB1, 00007FFD93B9AED9, 00007FFD93B9AEFC, 00007FFD93B9AF69, 00007FFD93B9AFA3, 00007FFD93B9AFF3, 00007FFD93B9B12A
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93B9AA30, 00007FFD93B9ACBD, 00007FFD93B9AD01, 00007FFD93B9AD87, 00007FFD93B9ADA7, 00007FFD93B9ADCF, 00007FFD93B9ADF4, 00007FFD93B9AE2B, 00007FFD93B9AE98, 00007FFD93B9AEBD, 00007FFD93B9AF08, 00007FFD93B9AF75, 00007FFD93B9AFAF, 00007FFD93B9AFFF, 00007FFD93B9B136

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeR_newR_set_debugX509X509_freeX509_new_exd2i_
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_client_certificate
API String ID: 3085087540-2403068147
Opcode ID: 0354b7188ed3375122ca9793ddc61aaa29afc51b746fbb843e8a4165e2b2472e
Instruction ID: f4feab19a9f570fb24815cd365c8eece6bfced87e3aba055b52bf0c3dabff935
Opcode Fuzzy Hash: 0354b7188ed3375122ca9793ddc61aaa29afc51b746fbb843e8a4165e2b2472e
Instruction Fuzzy Hash: A112AD29F0868689FB64DBA5D4603B927A9EF44B8CF544036DDCD67696DF3CE580C301

Function 00007FFD93B2111D Relevance: 73.8, APIs: 39, Strings: 3, Instructions: 286COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFD93B331A3
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B331B0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B331C6
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B331D6
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B33233
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3324B
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3325C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B33271

Strings

ssl_cert_dup, xrefs: 00007FFD93B331B5, 00007FFD93B33238, 00007FFD93B333C0, 00007FFD93B33530
..\s\ssl\ssl_cert.c, xrefs: 00007FFD93B3319C, 00007FFD93B331BF, 00007FFD93B33244, 00007FFD93B33267, 00007FFD93B33310, 00007FFD93B3336E, 00007FFD93B333CC, 00007FFD93B3343E, 00007FFD93B3346C, 00007FFD93B33485, 00007FFD93B3349E, 00007FFD93B334DB, 00007FFD93B334FF, 00007FFD93B33558, 00007FFD93B335C0, 00007FFD93B336A5
gfffffff, xrefs: 00007FFD93B331EE

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_freeO_zalloc
String ID: ..\s\ssl\ssl_cert.c$gfffffff$ssl_cert_dup
API String ID: 1191937791-1697153846
Opcode ID: e048c4f90e9b58322efc39cd4b2d5113965c750834da7b20b8851709e95ac7b8
Instruction ID: d550f3c2b515e05dc0eb89282a74fd5f4f521ff8d33d4163183d8db5e1171d16
Opcode Fuzzy Hash: e048c4f90e9b58322efc39cd4b2d5113965c750834da7b20b8851709e95ac7b8
Instruction Fuzzy Hash: 59D16D76B09B9292EB68DBA5E4A02F963A8FF45B48F444035CB9D57791DF3CE160C301

Function 00007FFD93B21646 Relevance: 72.1, APIs: 39, Strings: 2, Instructions: 334COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?), ref: 00007FFD93B90AA3
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?), ref: 00007FFD93B90AB5
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?), ref: 00007FFD93B90ACD
X509_get0_pubkey.LIBCRYPTO-3(?,?,?,?,?,?,?,?), ref: 00007FFD93B90B03
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?), ref: 00007FFD93B90B10
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFD93B90B28
BIO_free.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFD93B90F86
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B90F99
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B90FAE

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93B90AC6, 00007FFD93B90B21, 00007FFD93B90B5D, 00007FFD93B90C02, 00007FFD93B90C39, 00007FFD93B90D66, 00007FFD93B90DA5, 00007FFD93B90DCD, 00007FFD93B90EA5, 00007FFD93B90F55, 00007FFD93B90FA4
tls_process_cert_verify, xrefs: 00007FFD93B90ABA, 00007FFD93B90B1A, 00007FFD93B90B51, 00007FFD93B90BF6, 00007FFD93B90C2D, 00007FFD93B90D5F, 00007FFD93B90DC1, 00007FFD93B90E9E, 00007FFD93B90F4E

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_freeR_newR_set_debug$X509_get0_pubkeyX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$tls_process_cert_verify
API String ID: 3996869770-4103244874
Opcode ID: 66300fe5e646592a600a1c3d30a2e16b2af59001e27b2c7f76db3dc982a12af8
Instruction ID: 251c483dab3c16c10e6fc376433cc700aa4e03bd65e23cfeabdf6c2b3f34f31e
Opcode Fuzzy Hash: 66300fe5e646592a600a1c3d30a2e16b2af59001e27b2c7f76db3dc982a12af8
Instruction Fuzzy Hash: 45E16F65B0DA8681FB309BA1D8713BA2768AF85B8CF544032DECD67796DF3CE5418301

Function 00007FFD93B21ACD Relevance: 59.9, APIs: 32, Strings: 2, Instructions: 405COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B9B3B4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9B3CC
CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFD93B9B432
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B9B43F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9B457
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B9B4C1
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9B4D9
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B9B50D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9B525
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B9B5EC
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9B604
memcpy.VCRUNTIME140 ref: 00007FFD93B9B69C
memcpy.VCRUNTIME140 ref: 00007FFD93B9B6CD
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B9B9E1
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B9B9F6

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93B9B3C5, 00007FFD93B9B426, 00007FFD93B9B450, 00007FFD93B9B4D2, 00007FFD93B9B51E, 00007FFD93B9B5FD, 00007FFD93B9B742, 00007FFD93B9B888, 00007FFD93B9B8B2, 00007FFD93B9B9AB, 00007FFD93B9B9D4, 00007FFD93B9B9EC
tls_process_client_hello, xrefs: 00007FFD93B9B3B9, 00007FFD93B9B444, 00007FFD93B9B4C6, 00007FFD93B9B517, 00007FFD93B9B5F1, 00007FFD93B9B73B, 00007FFD93B9B8AB, 00007FFD93B9B99F

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$O_freememcpy$O_zalloc
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_client_hello
API String ID: 2132817427-1456301196
Opcode ID: fe31296bb74389f9af1a5b5efb65c5e411fb909f44afabc2a672daddc9d9e7d0
Instruction ID: ceae154858ada0161f365d60a463d044d6f6c964d621bcae385bca329f18e262
Opcode Fuzzy Hash: fe31296bb74389f9af1a5b5efb65c5e411fb909f44afabc2a672daddc9d9e7d0
Instruction Fuzzy Hash: C002A162B1CA5282EB34DBA1D4B42B933A9EB4578CF508135DADE26BD5DF3CE191C300

Function 00007FFD93B2162C Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD93B8F8B9
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B8F8C6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B8F8DE
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B8F935
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B8FB94
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B8FBA0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B8FBB8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B8FBE2
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B8FBEA

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93B8F8D7, 00007FFD93B8F99D, 00007FFD93B8FA4A, 00007FFD93B8FACD, 00007FFD93B8FB67, 00007FFD93B8FBB1, 00007FFD93B8FBD8
tls_construct_cert_verify, xrefs: 00007FFD93B8F8CB, 00007FFD93B8F996, 00007FFD93B8FBAA

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_new$R_set_debug$O_freeX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$tls_construct_cert_verify
API String ID: 3285935519-2275373907
Opcode ID: fa070d2f81ccd89c61bee42e883de4a69c782245a686f86bc9d834ee74e3a6c5
Instruction ID: 0d1148e4d76b5e9a02435053629ef5846f2609a6f00a8d83042bd1e0369ecaf0
Opcode Fuzzy Hash: fa070d2f81ccd89c61bee42e883de4a69c782245a686f86bc9d834ee74e3a6c5
Instruction Fuzzy Hash: 69A16265B0C64292F63097D6E8712BA63A9EF85BCCF544032EECD67796DE3CE5428700

Function 00007FFD93B2155A Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 295COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B79303
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7931B
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B79364
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7937C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7942D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B79445
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B79493
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B794AB
EVP_PKEY_get1_encoded_public_key.LIBCRYPTO-3 ref: 00007FFD93B794D3
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B794DD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B794F5
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93B79512
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B796B6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B796CE
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B796FA
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B79703
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7971B

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD93B79314, 00007FFD93B79375, 00007FFD93B7943E, 00007FFD93B794A4, 00007FFD93B794EE, 00007FFD93B79549, 00007FFD93B7958C, 00007FFD93B795BA, 00007FFD93B79615, 00007FFD93B79669, 00007FFD93B796C7, 00007FFD93B796F3, 00007FFD93B79714
tls_construct_stoc_key_share, xrefs: 00007FFD93B79308, 00007FFD93B79369, 00007FFD93B79432, 00007FFD93B79498, 00007FFD93B794E2, 00007FFD93B79580, 00007FFD93B79609, 00007FFD93B796BB, 00007FFD93B79708

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$O_freeY_freeY_get1_encoded_public_key
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_construct_stoc_key_share
API String ID: 3583904855-2937429030
Opcode ID: ca327c01b2cf45c7887322f355246544e799265d1ce5d58aea540e5b17637990
Instruction ID: 76bb63cab66e41ed5b9656e307276bb9e81a385e081f3af36e21be3fa1ee2ef2
Opcode Fuzzy Hash: ca327c01b2cf45c7887322f355246544e799265d1ce5d58aea540e5b17637990
Instruction Fuzzy Hash: ACC19E25B0C25281FB74EBA2E5716BA225AEF94BCCF440431DECE67BD6DE2CE5418740

Function 00007FFD93B21FD7 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D3DA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7D3F2
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D462
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7D47A
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93B7D4A4
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD93B7D4B3
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D4C4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7D4DC
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFD93B7D5B2
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93B7D64E
d2i_X509_EXTENSIONS.LIBCRYPTO-3 ref: 00007FFD93B7D65D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D67D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7D695
OCSP_RESPID_free.LIBCRYPTO-3 ref: 00007FFD93B7D6B7
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D6BC
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7D6D4
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D6FD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7D715
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D734
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7D74C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D76B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7D783
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D7A2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7D7BA

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD93B7D3EB, 00007FFD93B7D473, 00007FFD93B7D4D5, 00007FFD93B7D68E, 00007FFD93B7D6CD, 00007FFD93B7D70E, 00007FFD93B7D745, 00007FFD93B7D77C, 00007FFD93B7D7B3
tls_parse_ctos_status_request, xrefs: 00007FFD93B7D3DF, 00007FFD93B7D467, 00007FFD93B7D4C9, 00007FFD93B7D682, 00007FFD93B7D6C1, 00007FFD93B7D702, 00007FFD93B7D739, 00007FFD93B7D770, 00007FFD93B7D7A7

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_pop_free$D_freeL_sk_new_nullL_sk_pushX509_d2i_
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_status_request
API String ID: 1108277277-3579644669
Opcode ID: 48741fe2d73178f61e43c334fa4417c021071366d507bc585875475cc1d4e258
Instruction ID: ce8fcb6a3f77a82a0a1a25e60995b0835d8a1dc12f3f50d4d543e96d800ff56e
Opcode Fuzzy Hash: 48741fe2d73178f61e43c334fa4417c021071366d507bc585875475cc1d4e258
Instruction Fuzzy Hash: 75B18E22B0C68281EB74DBA5E8615FA63A8EF9538CF444535DACE63A92DF3CE551C700

Function 00007FFD93B83420 Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 207COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,00007FFD93B8504D), ref: 00007FFD93B83470
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00007FFD93B8504D), ref: 00007FFD93B83488
X509_get0_pubkey.LIBCRYPTO-3(?,?,?,?,00007FFD93B8504D), ref: 00007FFD93B834BF
EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3(?,?,?,?,00007FFD93B8504D), ref: 00007FFD93B834D8
ERR_new.LIBCRYPTO-3(?,?,?,?,00007FFD93B8504D), ref: 00007FFD93B834E5
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00007FFD93B8504D), ref: 00007FFD93B834FD

Strings

tls_construct_cke_gost, xrefs: 00007FFD93B83475, 00007FFD93B834EA, 00007FFD93B83729
, xrefs: 00007FFD93B8366E
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93B83481, 00007FFD93B834F6, 00007FFD93B8352C, 00007FFD93B83732, 00007FFD93B8375E

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$X509_get0_pubkeyX_new_from_pkey
String ID: $..\s\ssl\statem\statem_clnt.c$tls_construct_cke_gost
API String ID: 3869628303-1144584530
Opcode ID: 8355a11617973a3a9c271e8226d5d584887406d8c4f71a30efb2c1e149aa921b
Instruction ID: 4f06c8807f0cde35e0cd7847c5e2e8f91f45eb3f2fe7942dc38c5faffec5f6cb
Opcode Fuzzy Hash: 8355a11617973a3a9c271e8226d5d584887406d8c4f71a30efb2c1e149aa921b
Instruction Fuzzy Hash: 6291506AB1C74246FA74ABA2D475BFA2658BF89B8CF440031DD8D6B796DF3CE5008740

Function 00007FFD93B69370 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B693DD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B693F5
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFD93B69429
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFD93B69436
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B69440
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B69458

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FFD93B693EE, 00007FFD93B69451, 00007FFD93B694B8, 00007FFD93B6958E, 00007FFD93B69673, 00007FFD93B696B7, 00007FFD93B69714, 00007FFD93B6975C
dtls1_process_record, xrefs: 00007FFD93B693E2, 00007FFD93B69445, 00007FFD93B694AC, 00007FFD93B69582, 00007FFD93B69667, 00007FFD93B696AB, 00007FFD93B69708

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$D_get_sizeX_get0_md
String ID: ..\s\ssl\record\ssl3_record.c$dtls1_process_record
API String ID: 1548276727-2476007939
Opcode ID: 178ddcd360d4b3a12c89ccc30972a41ae4475cc8a7a2d8035e9ef9ed616f317d
Instruction ID: a74299a696e96320746b0e21d23a16b759ba567b7e6184cad4187e46f2148775
Opcode Fuzzy Hash: 178ddcd360d4b3a12c89ccc30972a41ae4475cc8a7a2d8035e9ef9ed616f317d
Instruction Fuzzy Hash: D1B17E36B0964291FB709BA1E8206B93369FF84B9CF444032DACD67696DF3CE565C700

Function 00007FFD93B2230B Relevance: 42.4, APIs: 20, Strings: 4, Instructions: 388COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B874BF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B874D7
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFD93B87532
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B87564
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B8758D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B875AE
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B875CC
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FFD93B8770E
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B8772B
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B878BA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B878D2
EVP_MD_free.LIBCRYPTO-3 ref: 00007FFD93B878EE
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B87908

Strings

resumption, xrefs: 00007FFD93B8783A
SHA2-256, xrefs: 00007FFD93B876FD
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93B874D0, 00007FFD93B87550, 00007FFD93B8756C, 00007FFD93B8777A, 00007FFD93B87811, 00007FFD93B87881, 00007FFD93B878CB, 00007FFD93B878FB
tls_process_new_session_ticket, xrefs: 00007FFD93B874C9, 00007FFD93B8776E, 00007FFD93B87805, 00007FFD93B878C4

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_new$O_freeR_set_debug$D_fetchD_freeO_malloc_time64
String ID: ..\s\ssl\statem\statem_clnt.c$SHA2-256$resumption$tls_process_new_session_ticket
API String ID: 4294151624-1635961163
Opcode ID: c7af424069aa15eee3a1ff15ccabd709f4a38e17076db407352773dc70be74d1
Instruction ID: 95d921edb422317b17478d57f72669315e23f3f4910c270e8f0ff8fb383f5bc2
Opcode Fuzzy Hash: c7af424069aa15eee3a1ff15ccabd709f4a38e17076db407352773dc70be74d1
Instruction Fuzzy Hash: 5E02A272B0968282E730CB95E4A13B977A9EB84B8CF148135DADD677A5DF3CD191C700

Function 00007FFD93B99790 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B9981A
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B99827
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B9983F
EVP_PKEY_decrypt_init.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B99862
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B9986B
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B99883
X509_get0_pubkey.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B998BA
ERR_clear_error.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B998D3
ASN1_item_d2i.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B998F2
ASN1_TYPE_get.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B9990F
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B99945
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B9995D
EVP_PKEY_decrypt.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B9998C
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B99995
EVP_PKEY_CTX_ctrl.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B999D5
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B99A13
EVP_PKEY_CTX_free.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B99A31
ASN1_item_free.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B9BCB6), ref: 00007FFD93B99A40

Strings

, xrefs: 00007FFD93B997C0
tls_process_cke_gost, xrefs: 00007FFD93B9982C, 00007FFD93B99870, 00007FFD93B9994F, 00007FFD93B99A05
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93B99838, 00007FFD93B9987C, 00007FFD93B99956, 00007FFD93B99A0C

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$E_getN1_item_d2iN1_item_freeR_clear_errorX509_get0_pubkeyX_ctrlX_freeX_new_from_pkeyY_decryptY_decrypt_init
String ID: $..\s\ssl\statem\statem_srvr.c$tls_process_cke_gost
API String ID: 46435683-2809538378
Opcode ID: e18635b5dd13bb857b5ee75ac4588eab4e323f20d50603a590beb7fe783099d7
Instruction ID: 7fa5b4e765be9b04cd20423dac3e012d88f97a1445de77a694f13e8bd66dc193
Opcode Fuzzy Hash: e18635b5dd13bb857b5ee75ac4588eab4e323f20d50603a590beb7fe783099d7
Instruction Fuzzy Hash: F071A065B08A8281FA74DBA6E4A16B93369EF84B8CF544035DECE27796DE3CE401C300

Function 00007FFD93B2144C Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD93B913C1
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B913D2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B913EA
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B9141F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B91437
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B91458
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B9149C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B914B4
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B914FF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B91517

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93B913E3, 00007FFD93B91430, 00007FFD93B914AD, 00007FFD93B91510, 00007FFD93B9155C, 00007FFD93B915A9, 00007FFD93B915E6
tls_process_finished, xrefs: 00007FFD93B914A1, 00007FFD93B91504, 00007FFD93B91550, 00007FFD93B9159D, 00007FFD93B915DA
tls13_save_handshake_digest_for_pha, xrefs: 00007FFD93B913D7, 00007FFD93B91424

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$X_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$tls13_save_handshake_digest_for_pha$tls_process_finished
API String ID: 1676177304-1286925996
Opcode ID: 70252e26435c598d36948de3f9f42d7969caea64793bb3b708012f7c0e9b5c89
Instruction ID: 2ca2584725deff46e5f30da0deb9bacd0c6dffa37846f5888d27aa6a29f890a8
Opcode Fuzzy Hash: 70252e26435c598d36948de3f9f42d7969caea64793bb3b708012f7c0e9b5c89
Instruction Fuzzy Hash: FBA17B26B0868282FB71EBA5D8706FD2268EF84B8CF584036DACD67695DF3CE541D740

Function 00007FFD93B2176C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B4F6FA
CRYPTO_THREAD_lock_new.LIBCRYPTO-3 ref: 00007FFD93B4F7F6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B4F817
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B4F81F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B4F837
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B4F848
X509_up_ref.LIBCRYPTO-3 ref: 00007FFD93B4F896
X509_chain_up_ref.LIBCRYPTO-3 ref: 00007FFD93B4F8B9
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD93B4F8E7
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD93B4F915
CRYPTO_dup_ex_data.LIBCRYPTO-3 ref: 00007FFD93B4F93D
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD93B4F963
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93B4F99C
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93B4F9E1
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD93B4FA0F
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93B4FA44

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFD93B4F6E8, 00007FFD93B4F80D, 00007FFD93B4F830, 00007FFD93B4F8E0, 00007FFD93B4F90E, 00007FFD93B4F95C, 00007FFD93B4F98F, 00007FFD93B4F9D4, 00007FFD93B4FA08, 00007FFD93B4FA37
ssl_session_dup, xrefs: 00007FFD93B4F824

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_strdup$O_memdup$D_lock_newO_dup_ex_dataO_freeO_mallocR_newR_set_debugR_set_errorX509_chain_up_refX509_up_ref
String ID: ..\s\ssl\ssl_sess.c$ssl_session_dup
API String ID: 1347456398-2356865551
Opcode ID: c91e6a8d12510ecb13b80947944277ea1fb9b98c3fc597ebccf6540816cd0e10
Instruction ID: c15f57159d35f0b2eadd33fed4b27e7163c7104c77183c0b45f34d57b9eab2eb
Opcode Fuzzy Hash: c91e6a8d12510ecb13b80947944277ea1fb9b98c3fc597ebccf6540816cd0e10
Instruction Fuzzy Hash: B3916226B09B8282EB659FA4D5643BC23A8FF4474CF085635DF8D2B696DF38E254C314

Function 00007FFD93B2F7F0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B2F827
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B2F83F
EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3 ref: 00007FFD93B2F875
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B2F8D9
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B2F8F3
EVP_PKEY_encapsulate.LIBCRYPTO-3 ref: 00007FFD93B2F91D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B2F926
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B2F9B8
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD93B2F9E7
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B2F9FC
EVP_PKEY_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B2FA04

Strings

ssl_encapsulate, xrefs: 00007FFD93B2F82C, 00007FFD93B2F980, 00007FFD93B2F9AA
..\s\ssl\s3_lib.c, xrefs: 00007FFD93B2F838, 00007FFD93B2F8D2, 00007FFD93B2F8E3, 00007FFD93B2F98C, 00007FFD93B2F9B1, 00007FFD93B2F9D7, 00007FFD93B2F9F2

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_mallocR_newR_set_debug$O_clear_freeO_freeX_freeX_new_from_pkeyY_encapsulate
String ID: ..\s\ssl\s3_lib.c$ssl_encapsulate
API String ID: 1298386825-1554727935
Opcode ID: 1779be5004fc6655a02527e1373e511c72f1684f09e346fefe886900125854f5
Instruction ID: f949f9c57b2b0c5014883bc19e30fab8d3614f6a2511504b83c8074d8f53b0b7
Opcode Fuzzy Hash: 1779be5004fc6655a02527e1373e511c72f1684f09e346fefe886900125854f5
Instruction Fuzzy Hash: 2051C125B0DA4691FA20ABA6E4205E96399FF94BCCF504132EEDD67BA5DE3CD201C700

Function 00007FFD93B21ED8 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B35357
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B35364
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3537C
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3538D
OPENSSL_sk_find.LIBCRYPTO-3 ref: 00007FFD93B353C1
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B353DA
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B353DF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B353F7
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFD93B35412
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B3543D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B35442
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B35458
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B35470
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B35481

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FFD93B3534B, 00007FFD93B35375, 00007FFD93B353D0, 00007FFD93B353F0, 00007FFD93B35433, 00007FFD93B35469
SSL_COMP_add_compression_method, xrefs: 00007FFD93B35369, 00007FFD93B353E4, 00007FFD93B35447, 00007FFD93B3545D

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_new$R_set_debug$O_freeR_set_error$L_sk_findL_sk_pushO_malloc
String ID: ..\s\ssl\ssl_ciph.c$SSL_COMP_add_compression_method
API String ID: 672050802-2070406874
Opcode ID: 9f021bad75a4e6b4102f4990fd09031ac56448d5f8cec8470e7aba382fa825b0
Instruction ID: 4c5841be4283e5e39eb4bb6198f94fa7bb4a274c3ddf2322da72f9b517a1b7dd
Opcode Fuzzy Hash: 9f021bad75a4e6b4102f4990fd09031ac56448d5f8cec8470e7aba382fa825b0
Instruction Fuzzy Hash: 7E41A269F0DA6242F778DB95F4312B9225CAF8478CF905032E98DA76DADE3CE5418740

Function 00007FFD93B22121 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93B4F1F7
CRYPTO_THREAD_read_lock.LIBCRYPTO-3 ref: 00007FFD93B4F20B
OPENSSL_LH_retrieve.LIBCRYPTO-3 ref: 00007FFD93B4F228
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD93B4F24A
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD93B4F262
memcmp.VCRUNTIME140 ref: 00007FFD93B4F32B
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B4F346
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B4F35E
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFD93B4F382
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B4F3E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B4F3FC
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B4F491
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B4F4A9

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFD93B4F357, 00007FFD93B4F3F5, 00007FFD93B4F4A2
ssl_get_prev_session, xrefs: 00007FFD93B4F34B, 00007FFD93B4F3E9, 00007FFD93B4F496

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$D_unlock$D_read_lockH_retrieve_time64memcmpmemcpy
String ID: ..\s\ssl\ssl_sess.c$ssl_get_prev_session
API String ID: 2856374240-1331951588
Opcode ID: 0352ad9fc4eb995808501633053fa83929032a4800353e971eb6e04da81094a5
Instruction ID: b1d0c7f2b1071812e81babb350ae298106cfee786a51fefd709f86a9eddbf5c6
Opcode Fuzzy Hash: 0352ad9fc4eb995808501633053fa83929032a4800353e971eb6e04da81094a5
Instruction Fuzzy Hash: 1BC15B36B0868282EB759BA1E4687A93368FB84B8CF144131DF8D67799CF3CE545C704

Function 00007FFD93B21997 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B2F323
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B2F33B
EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3 ref: 00007FFD93B2F371
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B2F3BC
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B2F3C9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B2F3E1
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD93B2F497
EVP_PKEY_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B2F49F

Strings

ssl_decapsulate, xrefs: 00007FFD93B2F328, 00007FFD93B2F3CE, 00007FFD93B2F45A
..\s\ssl\s3_lib.c, xrefs: 00007FFD93B2F334, 00007FFD93B2F3AF, 00007FFD93B2F3DA, 00007FFD93B2F461, 00007FFD93B2F487

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$O_clear_freeO_mallocX_freeX_new_from_pkey
String ID: ..\s\ssl\s3_lib.c$ssl_decapsulate
API String ID: 263585440-1707435976
Opcode ID: ab134989e51251d2ccc5febe5e765c777229d13a9e84380efe71cd13ba7c89ed
Instruction ID: 83ac1f6d78df8dc6ccf862bc1bd669c64223e3258cb2d46444b48d1942712c6b
Opcode Fuzzy Hash: ab134989e51251d2ccc5febe5e765c777229d13a9e84380efe71cd13ba7c89ed
Instruction Fuzzy Hash: 3541A525B0D69285FA30ABD2E8205BA6359EF98BCCF540132EEDD67B95DE7CE101C740

Function 00007FFD93B4D750 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD93B21087: ERR_new.LIBCRYPTO-3 ref: 00007FFD93B3B75F
Part of subcall function 00007FFD93B21087: ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3B777
Part of subcall function 00007FFD93B21087: ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3B788

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFD93B4D78B
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B4D798
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B4D7B0
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B4D7C0

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFD93B4D77F, 00007FFD93B4D7A9, 00007FFD93B4D85E, 00007FFD93B4D8AD
SSL_SESSION_new, xrefs: 00007FFD93B4D79D, 00007FFD93B4D852

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_zalloc
String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new
API String ID: 1179349375-402823876
Opcode ID: 14345e81860665dd88fc5b21882cf9813976ce1dd4121f2083c28ab1b41d5a00
Instruction ID: 18ff6b793b0c79d5c2246a35e4148f09e739634f38fe6e31e6069c6a6f27f6a7
Opcode Fuzzy Hash: 14345e81860665dd88fc5b21882cf9813976ce1dd4121f2083c28ab1b41d5a00
Instruction Fuzzy Hash: AB41AD25B19B4282FB65EBA1D4757FD2298FF88B4CF84403AD98D667A6DE3CE1018704

Function 00007FFD93B211DB Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93B33863
X509_free.LIBCRYPTO-3 ref: 00007FFD93B33877
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93B33884
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93B33897
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B338B0
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B338EA
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B33903
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B3391C
X509_STORE_free.LIBCRYPTO-3 ref: 00007FFD93B33928
X509_STORE_free.LIBCRYPTO-3 ref: 00007FFD93B33934
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B33959
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FFD93B33965
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B3397A

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFD93B338A0, 00007FFD93B338CE, 00007FFD93B338F6, 00007FFD93B3390F, 00007FFD93B3394C, 00007FFD93B33970

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_free$E_freeX509_Y_free$D_lock_freeL_sk_pop_freeX509_free
String ID: ..\s\ssl\ssl_cert.c
API String ID: 3478116879-349359282
Opcode ID: 73eeb4c5e27859a205d1f8c0647ef6662eeac154cd29ec974cee8680553f9db9
Instruction ID: 22a6f59c221ef95480483526121c3aff55a8a72f32b6f8743167320afeea66ae
Opcode Fuzzy Hash: 73eeb4c5e27859a205d1f8c0647ef6662eeac154cd29ec974cee8680553f9db9
Instruction Fuzzy Hash: 7E319236B18A9291EB64ABA5D5A03BC7328FB85F9CF440031DE9E67796CF3CE5518300

Function 00007FFD93B83210 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B8323F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B83257
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B83295
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B832AD
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B8338F
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93B83397

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93B83250, 00007FFD93B832A6, 00007FFD93B83307, 00007FFD93B83355, 00007FFD93B83382
tls_construct_cke_ecdhe, xrefs: 00007FFD93B83244, 00007FFD93B8329A, 00007FFD93B832FB, 00007FFD93B83349

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$O_freeY_free
String ID: ..\s\ssl\statem\statem_clnt.c$tls_construct_cke_ecdhe
API String ID: 110670684-68429018
Opcode ID: 19574f2e61a281cf3ab16a34cf9e91df21e7e9f984fe4a11bad3e619a205312a
Instruction ID: e4c58f88c3c1d39f371e272f8472c0f274bfaeb1de4071a23ea80fdcd4286c67
Opcode Fuzzy Hash: 19574f2e61a281cf3ab16a34cf9e91df21e7e9f984fe4a11bad3e619a205312a
Instruction Fuzzy Hash: 6B419329F1C34286E670EBE1E8716B92228AF95BCCF540031DECC27B96DE7CE6458754

Function 00007FFD93B2D140 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B2D15D
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD93B2D1B3
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B2D1C8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B2D1E0
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B2D1F1
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B2D1FD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B2D215
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B2D226
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B2D22F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B2D247
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B2D258

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFD93B2D150, 00007FFD93B2D1A9, 00007FFD93B2D1D9, 00007FFD93B2D20E, 00007FFD93B2D240
ssl3_ctrl, xrefs: 00007FFD93B2D1CD, 00007FFD93B2D202, 00007FFD93B2D234

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_freeO_strdup
String ID: ..\s\ssl\s3_lib.c$ssl3_ctrl
API String ID: 1111623124-3079590724
Opcode ID: f81a6dad30362f2ac4d5aea5d7ea7990be999d68f5c66084f97cb660a3f56ef9
Instruction ID: bd2030c779d6e8a6eb3dfbd3f95bce44f574ec0db774d1111f2006208fd124b6
Opcode Fuzzy Hash: f81a6dad30362f2ac4d5aea5d7ea7990be999d68f5c66084f97cb660a3f56ef9
Instruction Fuzzy Hash: DD31DF19F2DA9696F7B0E7E0D8307F82249AF1534CFA00035D99DA2AD2DF2CE442D215

Function 00007FFD93944440 Relevance: 21.5, APIs: 2, Strings: 12, Instructions: 452COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FFD939448C2
memcpy.VCRUNTIME140 ref: 00007FFD939449C4

Strings

mode, xrefs: 00007FFD9394479E
%s mode not allowed: %s, xrefs: 00007FFD9394497E
mode, xrefs: 00007FFD93944921
cach, xrefs: 00007FFD939447AF
no such vfs: %s, xrefs: 00007FFD93944A74
invalid uri authority: %.*s, xrefs: 00007FFD939445C7
no such %s mode: %s, xrefs: 00007FFD939448EE
access, xrefs: 00007FFD93944885
localhos, xrefs: 00007FFD9394459E
cache, xrefs: 00007FFD9394485B
file, xrefs: 00007FFD939444BB
cach, xrefs: 00007FFD93944940

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcmpmemcpy
String ID: %s mode not allowed: %s$access$cach$cach$cache$file$invalid uri authority: %.*s$localhos$mode$mode$no such %s mode: %s$no such vfs: %s
API String ID: 1784268899-1067337024
Opcode ID: 3f8308d3fd2b10f9cc1c487fd35f85b6cf851aebd3b3235ad9291f3a453954cb
Instruction ID: 7f958131e9988539cfc55a7dbf27f7dff203b7c7b5d927d6ad4d65c24d7cf7f9
Opcode Fuzzy Hash: 3f8308d3fd2b10f9cc1c487fd35f85b6cf851aebd3b3235ad9291f3a453954cb
Instruction Fuzzy Hash: 6F023572B0C6A265FF758B94913837B6BD9AB52B94F144235CA6E633C1DE3DE9028700

Function 00007FFD93B89850 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B898CE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B898E6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B89935
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B899D5
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B899ED

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93B898DF, 00007FFD93B8992E, 00007FFD93B899AD, 00007FFD93B899E6
tls_process_ske_psk_preamble, xrefs: 00007FFD93B898D3, 00007FFD93B899A1, 00007FFD93B899DA
D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD93B8996C, 00007FFD93B8997E

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$O_free
String ID: ..\s\ssl\statem\statem_clnt.c$D:\a\1\s\include\internal/packet.h$tls_process_ske_psk_preamble
API String ID: 1233037391-1906891150
Opcode ID: c32beb0c017250df2eee1c67452449d6fc53f1958ce219b8d056d47456d4651c
Instruction ID: 5f4dfb54d6bf31b5db8655f4dc40c2a8f8a8d54f907c4671e192941544f5336d
Opcode Fuzzy Hash: c32beb0c017250df2eee1c67452449d6fc53f1958ce219b8d056d47456d4651c
Instruction Fuzzy Hash: 3241A726F2869186E730DBA5E4257ED6368FB54B88F440131EACC27B95DF3CE551C700

Function 00007FFD93B21582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B617C3
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B617DC
BN_free.LIBCRYPTO-3 ref: 00007FFD93B617E8
BN_free.LIBCRYPTO-3 ref: 00007FFD93B617F4
BN_free.LIBCRYPTO-3 ref: 00007FFD93B61800
BN_free.LIBCRYPTO-3 ref: 00007FFD93B6180C
BN_free.LIBCRYPTO-3 ref: 00007FFD93B61818
BN_free.LIBCRYPTO-3 ref: 00007FFD93B61824
BN_free.LIBCRYPTO-3 ref: 00007FFD93B61830
BN_free.LIBCRYPTO-3 ref: 00007FFD93B6183C

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFD93B617B6, 00007FFD93B617CF

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: N_free$O_free
String ID: ..\s\ssl\tls_srp.c
API String ID: 3506937590-1778748169
Opcode ID: 6781f8122e26c314c91ead8aaa1f52217c11aaa97b0d55223e0b2e92c9ed18e1
Instruction ID: ad07375f8a9998feaae46f969151b2cf38d6d00dcf88b6200197fda19969fa2c
Opcode Fuzzy Hash: 6781f8122e26c314c91ead8aaa1f52217c11aaa97b0d55223e0b2e92c9ed18e1
Instruction Fuzzy Hash: 8121CB56F14A8286E756EF71C8A53FC232CEB94B4CF086231FE9C5A157DF68A6918310

Function 00007FFD93B712E0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B71322
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7133A
EVP_PKEY_get1_encoded_public_key.LIBCRYPTO-3 ref: 00007FFD93B71380
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B713E8
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B713FE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B71413
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93B71437
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B7144E

Strings

add_key_share, xrefs: 00007FFD93B71327, 00007FFD93B71403
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93B71333, 00007FFD93B713CD, 00007FFD93B7140C, 00007FFD93B71441

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_freeR_newR_set_debug$Y_freeY_get1_encoded_public_key
String ID: ..\s\ssl\statem\extensions_clnt.c$add_key_share
API String ID: 2306805868-2958431780
Opcode ID: 0effa3f28fd81e029e1e2bef8d3d4f795195dbca90a63bb6ef66fcf9d34d6eaf
Instruction ID: 13daf37b028ba24af5625320392dc8a976449cd5a07bb40edfb9e5536edcf01b
Opcode Fuzzy Hash: 0effa3f28fd81e029e1e2bef8d3d4f795195dbca90a63bb6ef66fcf9d34d6eaf
Instruction Fuzzy Hash: C841D421B0C65281EB70EB95E4357BA22A8EF45BCCF140431EECD27B96DE3CD6408314

Function 00007FFD93B635E0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B63635
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B6364B
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD93B6369B
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B636B0
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B636C6
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD93B6371B
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B63730
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B63746

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFD93B63624, 00007FFD93B6363E, 00007FFD93B636A3, 00007FFD93B636B9, 00007FFD93B63723, 00007FFD93B63739

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_free$L_cleanse
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 927910673-1306860146
Opcode ID: 87c20ce79d9b1f955aa4e8903e29a6a14f52e0d8b90f8ee282dfd8fdd339abbe
Instruction ID: ea78bc0354525d4d727f6a4d3b9d6ca6169aa2a1ef569a7b059135a972d14261
Opcode Fuzzy Hash: 87c20ce79d9b1f955aa4e8903e29a6a14f52e0d8b90f8ee282dfd8fdd339abbe
Instruction Fuzzy Hash: C7515E62F19B4281EB20DF66D5602B92365FF88F8CF049236DE8D2775ADF28E591C300

Function 00007FFD93B220EF Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B591D9
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B591E6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B591FE
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B5920E

Strings

tls1_set_sigalgs, xrefs: 00007FFD93B591EB
..\s\ssl\t1_lib.c, xrefs: 00007FFD93B591BD, 00007FFD93B591F7, 00007FFD93B59275, 00007FFD93B592A9

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_mallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$tls1_set_sigalgs
API String ID: 2261483606-2076144160
Opcode ID: d1036dbe8b9a9d680c55c8a37dc255ee52f0efd95901680dc470d1b35e351fcc
Instruction ID: 04df2331f83ed1f579ecbd8a9ba220eacefa5cd503794ba84ef8326d7797b70d
Opcode Fuzzy Hash: d1036dbe8b9a9d680c55c8a37dc255ee52f0efd95901680dc470d1b35e351fcc
Instruction Fuzzy Hash: E241E431F0875286EB74DBE5E4606BA7269EB5AB88F444035DE8D23B85DE3DE441C310

Function 00007FFD93B211BD Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B593FA
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B59407
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B5941F
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B5942F

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFD93B593D1, 00007FFD93B59418, 00007FFD93B59446
tls1_set_raw_sigalgs, xrefs: 00007FFD93B5940C

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_mallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$tls1_set_raw_sigalgs
API String ID: 2261483606-2202831108
Opcode ID: f881d78ce60898aab7decfc7794186c0dca4c0da06903e580fa000e5301e5333
Instruction ID: 687d41a81c47f5575825409dbc5d17d18951e86ed202b3496e92789dec462b58
Opcode Fuzzy Hash: f881d78ce60898aab7decfc7794186c0dca4c0da06903e580fa000e5301e5333
Instruction Fuzzy Hash: 38315926719B8181EB70DB92E8617EA7269FB95B88F440136DECD27B85DF3CE540C710

Function 00007FFD93B22522 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B7B710
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93B7B737
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7B764
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7B77C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7B78E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7B7A6

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD93B7B775, 00007FFD93B7B79F
tls_parse_ctos_ec_pt_formats, xrefs: 00007FFD93B7B769, 00007FFD93B7B793
D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD93B7B703, 00007FFD93B7B717

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_memdup
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_ec_pt_formats
API String ID: 3243760035-2708166893
Opcode ID: 88ee1e5542640dcecb15f744e2d861319f0b7bd4ed1d6601734855cb29d92de7
Instruction ID: 69795519c331b72647d5ea755d09bc93af48dc2802dc204a64e0d545523072ce
Opcode Fuzzy Hash: 88ee1e5542640dcecb15f744e2d861319f0b7bd4ed1d6601734855cb29d92de7
Instruction Fuzzy Hash: A631A125B0DB8281E730DBA1E4206EA63A8FB5978CF544131DACD67B96DF3CE691C700

Function 00007FFD93B225D6 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B737C1
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B737DF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B737F7
memcpy.VCRUNTIME140 ref: 00007FFD93B73826
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7388C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B738A4

Strings

tls_construct_ctos_session_ticket, xrefs: 00007FFD93B737E4, 00007FFD93B73891
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93B737B2, 00007FFD93B737F0, 00007FFD93B7389D

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$O_mallocmemcpy
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_session_ticket
API String ID: 1077327330-3277354937
Opcode ID: 34f50cc33240a351c06fc794800c2bbf0ccc92b46abde09b13168cf331eeefe5
Instruction ID: e0051cf9037ed5033ae7633507e45692ea69747a59e7c1e492946a20ccb21580
Opcode Fuzzy Hash: 34f50cc33240a351c06fc794800c2bbf0ccc92b46abde09b13168cf331eeefe5
Instruction Fuzzy Hash: A141AF62B1864681FB749B95D4607F923A8FB44F88F484436DA8E63BD5CF7CEA90C340

Function 00007FFD938FD030 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 441COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938FD6A7

Strings

invalid, xrefs: 00007FFD938FD072
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938FD095
API call with %s database connection pointer, xrefs: 00007FFD938FD084
unopened, xrefs: 00007FFD938FD07D
misuse, xrefs: 00007FFD938FD0A2
%s at line %d of [%.10s], xrefs: 00007FFD938FD0AE
NULL, xrefs: 00007FFD938FD05D

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 3510742995-509082904
Opcode ID: b0b8f634f675646a45ae09d5aa13b1fee19ccf946b16911122f6aa39e7a08f8c
Instruction ID: c1d8d33493410e5f8925bdb7df84494e83eb3f8b14d5d2f54ca88c2f3baf9925
Opcode Fuzzy Hash: b0b8f634f675646a45ae09d5aa13b1fee19ccf946b16911122f6aa39e7a08f8c
Instruction Fuzzy Hash: 5D12A322B09A4285FB749FA5E46037967A9FF84B88F140131DF5D27798DF3EE8498380

Function 00007FFD9388F9A0 Relevance: 12.4, APIs: 2, Strings: 6, Instructions: 410COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD9388FA0B
memset.VCRUNTIME140 ref: 00007FFD9388FA94

Part of subcall function 00007FFD9388D070: memset.VCRUNTIME140 ref: 00007FFD9388D0D4

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 00007FFD9388FCC0
etilqs_, xrefs: 00007FFD9388F9C2, 00007FFD9388FC7A
winGetTempname5, xrefs: 00007FFD9388FC6C
winGetTempname2, xrefs: 00007FFD9388FAC7
winGetTempname1, xrefs: 00007FFD9388FB92
winGetTempname4, xrefs: 00007FFD9388FF6A

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memset
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 2221118986-463513059
Opcode ID: eb5f79aba4bea38bd825a63604eb10bbb66b1e7b509e787b10201f8779ad775e
Instruction ID: c3bf71b3d1d0b8c3b06049cd417e676932a4b0244fbc28628cc5116f4d545095
Opcode Fuzzy Hash: eb5f79aba4bea38bd825a63604eb10bbb66b1e7b509e787b10201f8779ad775e
Instruction Fuzzy Hash: 86E12751B1C3C607EE2C8BB939352786BA5AB45780F54813ADEAE577D2DE3DB612C300

Function 00007FFD938AE5A0 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 402COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD938AE6C3

Strings

Freelist: , xrefs: 00007FFD938AE737
Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u), xrefs: 00007FFD938AE8B1
max rootpage (%u) disagrees with header (%u), xrefs: 00007FFD938AE7BB
incremental_vacuum enabled with a max rootpage of zero, xrefs: 00007FFD938AE7DF
Page %u: never used, xrefs: 00007FFD938AE9A5
Failed to read ptrmap key=%u, xrefs: 00007FFD938AE88A
Page %u: pointer map referenced, xrefs: 00007FFD938AEA0F

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memset
String ID: Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u)$Failed to read ptrmap key=%u$Freelist: $Page %u: never used$Page %u: pointer map referenced$incremental_vacuum enabled with a max rootpage of zero$max rootpage (%u) disagrees with header (%u)
API String ID: 2221118986-741541785
Opcode ID: 28a4aea575f186a5dc83369c60b8f7852be6cfe7a455215f8c5df071ca59337c
Instruction ID: 3829d514f7720b4e736c7ef8b833dce7a22049bcae1d3e158f1e84a9081b74cc
Opcode Fuzzy Hash: 28a4aea575f186a5dc83369c60b8f7852be6cfe7a455215f8c5df071ca59337c
Instruction Fuzzy Hash: 10028D32B087828AE7348BA5E46027E77A5FB84744F141539DA8EA7B94DF7EF441CB10

Function 00007FFD93B37730 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3(?,00000000,?,00007FFD93B374DB), ref: 00007FFD93B37797
ERR_new.LIBCRYPTO-3(?,00000000,?,00007FFD93B374DB), ref: 00007FFD93B377A4
ERR_set_debug.LIBCRYPTO-3(?,00000000,?,00007FFD93B374DB), ref: 00007FFD93B377BC
ERR_set_error.LIBCRYPTO-3(?,00000000,?,00007FFD93B374DB), ref: 00007FFD93B377CC
CRYPTO_free.LIBCRYPTO-3(?,00000000,?,00007FFD93B374DB), ref: 00007FFD93B378A7

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FFD93B37782, 00007FFD93B377B5, 00007FFD93B3789D
ssl_cipher_strength_sort, xrefs: 00007FFD93B377A9

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_freeO_zallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_ciph.c$ssl_cipher_strength_sort
API String ID: 2487674020-1223572542
Opcode ID: b04ef35ca2b519efab378e83bc892820f751471ee896cde5e0915d34dc851a37
Instruction ID: 594eea0321d95589e915e72a20193ebebee98d17b0336625f2f67382956141ff
Opcode Fuzzy Hash: b04ef35ca2b519efab378e83bc892820f751471ee896cde5e0915d34dc851a37
Instruction Fuzzy Hash: 5E41BE76B05B51C6EA28CF96E56157837A8FB44BC8F548436DE8C63745EF38E940C340

Function 00007FFD93B77770 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93B777BC
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93B77836
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93B77856
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B778B8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B778CE
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B778F7

Strings

..\s\ssl\statem\extensions_cust.c, xrefs: 00007FFD93B777AB, 00007FFD93B77824, 00007FFD93B7783F, 00007FFD93B778AB, 00007FFD93B778C1, 00007FFD93B778EA

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\statem\extensions_cust.c
API String ID: 3962629258-3973221358
Opcode ID: f513b24519971439065d8ac0baefa25f29694b2f961c74c5c8df209c3117cd2f
Instruction ID: 11e1264af9c5141310815c96749129ee6d03eb83d8c9c7de6c739b18a7263622
Opcode Fuzzy Hash: f513b24519971439065d8ac0baefa25f29694b2f961c74c5c8df209c3117cd2f
Instruction Fuzzy Hash: 33416E36B09A4291EA30DB82F8616BA63A8FB44B8CF054036DEDE57B54DF7CE595C300

Function 00007FFD93B81126 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B811FD
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B81219
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B81231
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B8125B

Strings

tls_process_encrypted_extensions, xrefs: 00007FFD93B8121E
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93B811F0, 00007FFD93B8122A, 00007FFD93B8124E

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_free$R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_encrypted_extensions
API String ID: 3271392029-215004271
Opcode ID: 722d444f2522c4f7b79969b85d7b454d2b473e7931e03076ba07f6d6bf35ef80
Instruction ID: 350a05c1a450f38319a078b392ef5cb927a3aed3f075b976eee08475cb4d4eb8
Opcode Fuzzy Hash: 722d444f2522c4f7b79969b85d7b454d2b473e7931e03076ba07f6d6bf35ef80
Instruction Fuzzy Hash: 993198B2B1C68182E7608BD5F4646AAB7A8FB8479CF444131EACD67B59DF7CE1508B00

Function 00007FFD93B8D170 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B8D1AE
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B8D1BB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B8D1D3
memcpy.VCRUNTIME140 ref: 00007FFD93B8D225

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93B8D19A, 00007FFD93B8D1CC
construct_key_exchange_tbs, xrefs: 00007FFD93B8D1C0

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_mallocR_newR_set_debugmemcpy
String ID: ..\s\ssl\statem\statem_lib.c$construct_key_exchange_tbs
API String ID: 3542074325-1491770217
Opcode ID: 204a1c1f0aea44cfdd663ba2e0a8cdd82f61fa154370159ceae9c60c6935e93a
Instruction ID: 6dc1ffc5d38bfa8ed68e503749be4a69d7c4a975384dd99b53032c3a773e385e
Opcode Fuzzy Hash: 204a1c1f0aea44cfdd663ba2e0a8cdd82f61fa154370159ceae9c60c6935e93a
Instruction Fuzzy Hash: CB21D126F08B8192E611DBA5E9101E96724FBA8B88F459231DF8C23757EF38E291C300

Function 00007FFD93904D90 Relevance: 9.4, APIs: 3, Strings: 3, Instructions: 370COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93904DFF
memcpy.VCRUNTIME140 ref: 00007FFD9390501D
memcpy.VCRUNTIME140 ref: 00007FFD939050CE

Strings

statement too long, xrefs: 00007FFD93904FD3
database schema is locked: %s, xrefs: 00007FFD93904F76
out of memory, xrefs: 00007FFD93904E7F

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy$memset
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 438689982-1046679716
Opcode ID: cd591d41826fe4ba9b166995ad43329fff67ba6a6ce6b8cc81313ee949ac5f0c
Instruction ID: 6100fd939b22827778cd6e7e33983fd524af7772bed83ff0747f51eb6932e529
Opcode Fuzzy Hash: cd591d41826fe4ba9b166995ad43329fff67ba6a6ce6b8cc81313ee949ac5f0c
Instruction Fuzzy Hash: BFF18F26B0C68296EB74DFA5D4243BA6BA8FF85B88F084135DA4D2B795DF7DE440C700

Function 00007FFD93887316 Relevance: 9.3, APIs: 2, Strings: 4, Instructions: 332COMMON

Download Yara Rule

Strings

0123456789ABCDEF0123456789abcdef, xrefs: 00007FFD93887509
VUUU, xrefs: 00007FFD9388757B
-x0, xrefs: 00007FFD938875E6
VUUU, xrefs: 00007FFD9388744E

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID:
String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
API String ID: 0-2031831958
Opcode ID: 3073ff3188e9ee9edf11f2fc228c5f0a47d3828b9a10be925a8c8f8668dd9abb
Instruction ID: 85b385fd8e08dca869346a176f76ffc8c05fe67e663df0212ccae98564917222
Opcode Fuzzy Hash: 3073ff3188e9ee9edf11f2fc228c5f0a47d3828b9a10be925a8c8f8668dd9abb
Instruction Fuzzy Hash: ECD10462B1D68286EB74CB68D0A4B7D6BA9FB84784F454035EEAE53741DE3EE801C700

Function 00007FFD93B21262 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

X509_free.LIBCRYPTO-3 ref: 00007FFD93B330F4
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93B33101
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93B33114
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B3312D

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFD93B3311D

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: L_sk_pop_freeO_freeX509_freeY_free
String ID: ..\s\ssl\ssl_cert.c
API String ID: 1247630535-349359282
Opcode ID: 24b314e282b566103a9c86e58b143d12934b6053f160aa45369882e913cf9f7a
Instruction ID: 83012327eacc30f7287717fcfeb48321a093cd4a5bcb992eb94c67ec03816b31
Opcode Fuzzy Hash: 24b314e282b566103a9c86e58b143d12934b6053f160aa45369882e913cf9f7a
Instruction Fuzzy Hash: 46016D36B19B6281EB209B65E4A02AD7368FB88F8CF044121EBCD67B49CF7CD611C740

Function 00007FFD93B6D2F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

RAND_bytes_ex.LIBCRYPTO-3 ref: 00007FFD93B6D3D6
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93B6D3F9
memset.VCRUNTIME140 ref: 00007FFD93B6D455

Strings

..\s\ssl\record\tls_pad.c, xrefs: 00007FFD93B6D3EF

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: D_bytes_exO_mallocmemset
String ID: ..\s\ssl\record\tls_pad.c
API String ID: 2022753641-3631836059
Opcode ID: 20b6bad2e288fa1953e84d48e46959ade97dca001cf6e78dcd1cc0bfb829beb0
Instruction ID: 042ec4b4d18d04fd61a583f3511fe7078297ceca917b370e434fc3f7978ecd4f
Opcode Fuzzy Hash: 20b6bad2e288fa1953e84d48e46959ade97dca001cf6e78dcd1cc0bfb829beb0
Instruction Fuzzy Hash: 9861003371878446EA31CF62E4207AAB7A4F789B9CF084236EE8D47B45EE3CD5558700

Function 00007FFD93B397B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B3985C
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD93B39871

Strings

..\s\ssl\ssl_conf.c, xrefs: 00007FFD93B39855, 00007FFD93B39867
gfffffff, xrefs: 00007FFD93B3982D

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_freeO_strdup
String ID: ..\s\ssl\ssl_conf.c$gfffffff
API String ID: 2148955802-4123734156
Opcode ID: f6d5f6f74aca4813406220e93ac092d3ea3d90d5a024274672e554b65dd5b593
Instruction ID: cc22b3c1120756b2b00f157f113dfa9533d4d6061d0399d53d0378a255a179e3
Opcode Fuzzy Hash: f6d5f6f74aca4813406220e93ac092d3ea3d90d5a024274672e554b65dd5b593
Instruction Fuzzy Hash: 5421B072B1AB5585EE68DF96E46026823A5EBC8FC8F184035DE8D97759DF38E5008340

Function 00007FFD938A8000 Relevance: 6.6, APIs: 5, Instructions: 362COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938A8199
memset.VCRUNTIME140 ref: 00007FFD938A81AA
memcpy.VCRUNTIME140 ref: 00007FFD938A8228
memcpy.VCRUNTIME140 ref: 00007FFD938A8240
memset.VCRUNTIME140 ref: 00007FFD938A824F

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 77e25c771ba6286717df95284f334fab0eaaf05d81d0432005a158e8710a0453
Instruction ID: c92e46c6722379a5760557b6d32a5f7e511497b7eb90c85ea03da7383ad2d6c6
Opcode Fuzzy Hash: 77e25c771ba6286717df95284f334fab0eaaf05d81d0432005a158e8710a0453
Instruction Fuzzy Hash: 61E1D4727097C18AE7A08F65D0607BD7BA9FB44B84F449036EE4EA7785DE3ED8468310

Function 00007FFD93B7F660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3(?,00007FFD93B861CB), ref: 00007FFD93B7F697
CRYPTO_memdup.LIBCRYPTO-3(?,00007FFD93B861CB), ref: 00007FFD93B7F6C0

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD93B7F687, 00007FFD93B7F6B0

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 3962629258-2521442236
Opcode ID: b1ba4f676e7cba9f2f2b58de4d4b341a4c05a7496b7e0e1d6a7617de362f3e5d
Instruction ID: 1032dbab0088b515618096c2009119c7fa417ebda7f8a31347c3fb258679a8ef
Opcode Fuzzy Hash: b1ba4f676e7cba9f2f2b58de4d4b341a4c05a7496b7e0e1d6a7617de362f3e5d
Instruction Fuzzy Hash: D1012C3270AB8281EB609F42F89069A7368FB58B88F088431EFCC57B59DE3CD5518700

Function 00007FFD93B652A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B652E3

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFD93B652D6

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 2581946324-1306860146
Opcode ID: a0ea09f7b4caa632463648e6a5a3eac89013ff4ec3887a629b3c32d42dcac195
Instruction ID: 986446337c41964101cd4c0a830a7d4703b428aa49c594a2f792648ba2769629
Opcode Fuzzy Hash: a0ea09f7b4caa632463648e6a5a3eac89013ff4ec3887a629b3c32d42dcac195
Instruction Fuzzy Hash: 80F0E211F1850281EE60AB96F5616BD5214AF88FCCF480031EE9D1B78BDD2CD9A04700

Function 00007FFD93B219E7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B63885

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFD93B63878

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 2581946324-1306860146
Opcode ID: cc6244fca78a7524dd482868cb2f5aa3ca37d680b7610803850f313aa7fff9c9
Instruction ID: d15d6ccd2da5c42b8ed70dc8123885873d301f5f5a5683c73e14a48af0eebb9c
Opcode Fuzzy Hash: cc6244fca78a7524dd482868cb2f5aa3ca37d680b7610803850f313aa7fff9c9
Instruction Fuzzy Hash: 4AF04F66B0464680EBB0ABA6D4713FC6328EBC4F9CF140131DE5D9B6D6CE29D483C710

Function 00007FFD93B2D2E1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93B2D2F5

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFD93B2D2E8

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\s3_lib.c
API String ID: 2581946324-4238427508
Opcode ID: 6350cf16a9c0d126380f3fa9b0e1836d1dc1cf503f95eea3ecfac14a546e38b6
Instruction ID: ce33aaad785793baa81dfc298cf1f694afc5af94e9c2032f7e8f938708e1cfa8
Opcode Fuzzy Hash: 6350cf16a9c0d126380f3fa9b0e1836d1dc1cf503f95eea3ecfac14a546e38b6
Instruction Fuzzy Hash: D8E08622708A4180E750AB55F4402986359E781BACF084036DF4C4BA49CE79D0829311

Function 00007FFD93B2B200 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD93B2B22D

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FFD93B2B216

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_clear_free
String ID: ..\s\ssl\s3_enc.c
API String ID: 2011826501-1839494539
Opcode ID: a3fd00c98839b7e8c1664afbc487672423ed4b4892010f20281f31aa65610e19
Instruction ID: bf6d666e1aa33cb4c312082f05eacf1e4dfd7aa7cf58372bca6a4e9677340a97
Opcode Fuzzy Hash: a3fd00c98839b7e8c1664afbc487672423ed4b4892010f20281f31aa65610e19
Instruction Fuzzy Hash: 1AE01272B05A8586D7929BA5EC557E822ACFB0CF4CF580031ED5CDB752EE28C7938350

Function 00007FFD93B51250 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 214COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD93B527C0), ref: 00007FFD93B51315
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD93B527C0), ref: 00007FFD93B51333
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD93B527C0), ref: 00007FFD93B51358
ERR_set_error.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD93B527C0), ref: 00007FFD93B51369
EVP_MD_get0_name.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD93B527C0), ref: 00007FFD93B513C5
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD93B527C0), ref: 00007FFD93B51440
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD93B527C0), ref: 00007FFD93B51472
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD93B527C0), ref: 00007FFD93B514A6
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD93B527C0), ref: 00007FFD93B514DA
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD93B527C0), ref: 00007FFD93B51511

Strings

secret, xrefs: 00007FFD93B513E6
seed, xrefs: 00007FFD93B51418, 00007FFD93B5144A, 00007FFD93B5147C, 00007FFD93B514B0, 00007FFD93B514E4
digest, xrefs: 00007FFD93B513CD
..\s\ssl\t1_enc.c, xrefs: 00007FFD93B51321, 00007FFD93B515A2
TLS1-PRF, xrefs: 00007FFD93B5137C
tls1_PRF, xrefs: 00007FFD93B5131A, 00007FFD93B5159B

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: M_construct_octet_string$R_set_debug$D_get0_nameR_newR_set_error
String ID: ..\s\ssl\t1_enc.c$TLS1-PRF$digest$secret$seed$tls1_PRF
API String ID: 2018442406-343031646
Opcode ID: 66a3d005abe625f1938974e1217084bca44be8e60b87a58ccbf077f9680b8d71
Instruction ID: d87c4f36e078d1aa586641d6197e855bd68327f1518e516c4f537133457a75b1
Opcode Fuzzy Hash: 66a3d005abe625f1938974e1217084bca44be8e60b87a58ccbf077f9680b8d71
Instruction Fuzzy Hash: 54B17F26A08BC685E771DFA4D8512E96774FB9978CF105232EE8D27656EF38E284C700

Function 00007FFD93B21942 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B3F859
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3F871
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3F882
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B3F89E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3F8B6
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3F8C7

Strings

SSL_dane_enable, xrefs: 00007FFD93B3F85E, 00007FFD93B3F8A3, 00007FFD93B3F900, 00007FFD93B3F954, 00007FFD93B3F9C2
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B3F86A, 00007FFD93B3F8AF, 00007FFD93B3F90C, 00007FFD93B3F960, 00007FFD93B3F9CE

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_dane_enable
API String ID: 1552677711-2910236719
Opcode ID: 732e637d63d256db1ddb73eaab57dc461342250b7c3bd114a68d03938ad656e2
Instruction ID: 7f97070fbc97ac179b2b5bf5be79080381ba2610c00381b6fd193ccf1e09ce58
Opcode Fuzzy Hash: 732e637d63d256db1ddb73eaab57dc461342250b7c3bd114a68d03938ad656e2
Instruction Fuzzy Hash: B541F365F2869292F7B4DBA4E8617ED2218EF4435CF940231EA9C176E2DE3CD985C704

Function 00007FFD93B49680 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3 ref: 00007FFD93B496AE
BIO_new.LIBCRYPTO-3 ref: 00007FFD93B496B6
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B496C3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B496DB
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD93B496F9
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B49702
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B4971A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B497EF
BIO_free.LIBCRYPTO-3 ref: 00007FFD93B497F7

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFD93B496D4, 00007FFD93B49713, 00007FFD93B4979A, 00007FFD93B497D7
SSL_CTX_use_PrivateKey_file, xrefs: 00007FFD93B496C8, 00007FFD93B49707, 00007FFD93B4978E, 00007FFD93B497CB

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeO_newO_s_fileR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_PrivateKey_file
API String ID: 1899708915-2252211958
Opcode ID: d94c28d24c7e937970c451ff150ad84ccb53ce58e2228629b3f1025ff047b185
Instruction ID: 900c5f5fe094f35397167dd19048d98a3ddb708713cf60e840fb7d26cf9a75c8
Opcode Fuzzy Hash: d94c28d24c7e937970c451ff150ad84ccb53ce58e2228629b3f1025ff047b185
Instruction Fuzzy Hash: 4C415325F0CA5281E660ABE2E8652FA2359AF84B8CF504032E9CC27796DF3CE5418745

Function 00007FFD93B992D0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,00007FFD93B9BC7D), ref: 00007FFD93B9933A
ERR_set_debug.LIBCRYPTO-3(?,?,?,00007FFD93B9BC7D), ref: 00007FFD93B99352
ERR_new.LIBCRYPTO-3(?,?,?,00007FFD93B9BC7D), ref: 00007FFD93B99368
ERR_set_debug.LIBCRYPTO-3(?,?,?,00007FFD93B9BC7D), ref: 00007FFD93B99380
ERR_new.LIBCRYPTO-3(?,?,?,00007FFD93B9BC7D), ref: 00007FFD93B9945C
ERR_set_debug.LIBCRYPTO-3(?,?,?,00007FFD93B9BC7D), ref: 00007FFD93B99474
EVP_PKEY_free.LIBCRYPTO-3(?,?,?,00007FFD93B9BC7D), ref: 00007FFD93B99492

Strings

tls_process_cke_dhe, xrefs: 00007FFD93B9933F, 00007FFD93B9936D, 00007FFD93B993D4, 00007FFD93B99437, 00007FFD93B99461
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93B9934B, 00007FFD93B99379, 00007FFD93B993E0, 00007FFD93B99443, 00007FFD93B9946D

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$Y_free
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_cke_dhe
API String ID: 2633058761-3621362005
Opcode ID: 8079ac5babdb914cc97b14bc09e57019c8c556e029d5a52e01bb6db19c09f5b8
Instruction ID: e4d1dca27063df070ad92f9a3df6f636a4a2674e63de041b0bcf6f12f5045768
Opcode Fuzzy Hash: 8079ac5babdb914cc97b14bc09e57019c8c556e029d5a52e01bb6db19c09f5b8
Instruction Fuzzy Hash: 9E416D65B0C65681FB70ABA1E8612BA7269AF85B8CF944031DE8D27BD2CF3CE541C344

Function 00007FFD93B356E0 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 101stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD93B35716
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD93B35747
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B357E0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B357F8
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B35809

Strings

SUITEB128ONLY, xrefs: 00007FFD93B3570A
SUITEB192, xrefs: 00007FFD93B35799
ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFD93B35833, 00007FFD93B35843
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFD93B3582C
ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FFD93B3584F
check_suiteb_cipher_list, xrefs: 00007FFD93B357E5
SUITEB128C2, xrefs: 00007FFD93B3573A
..\s\ssl\ssl_ciph.c, xrefs: 00007FFD93B357F1
SUITEB128, xrefs: 00007FFD93B3576B

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: strncmp$R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192$check_suiteb_cipher_list
API String ID: 1930259724-1099454403
Opcode ID: cd731b4d236905a648258da8a9046f31ad121a3fa299a8f54cbee44a92dc2aeb
Instruction ID: 5f3c4e6f107bb0e8bc63f9b7e8326b03a2eac19e6552dc29e656074ad69d36da
Opcode Fuzzy Hash: cd731b4d236905a648258da8a9046f31ad121a3fa299a8f54cbee44a92dc2aeb
Instruction Fuzzy Hash: E041A376B0DA56D6E7348BA5D86037833E8EB44B98F504436EA8DD3690DF3CE655C700

Function 00007FFD93B2B260 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD93B2B29D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B2B2A9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B2B2C1
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD93B2B2ED
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B2B2FE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B2B316
BIO_free.LIBCRYPTO-3 ref: 00007FFD93B2B410

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FFD93B2B2BA, 00007FFD93B2B30F, 00007FFD93B2B360, 00007FFD93B2B3D2
ssl3_digest_cached_records, xrefs: 00007FFD93B2B2AE, 00007FFD93B2B303, 00007FFD93B2B354, 00007FFD93B2B3C6

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeX_new
String ID: ..\s\ssl\s3_enc.c$ssl3_digest_cached_records
API String ID: 1193811298-2469352020
Opcode ID: 2e46933e6f4de043fb6c14859512636f0fe02399f739e516c4fcfa2488e6e28b
Instruction ID: a194ea63d436b822fb0ed8a99be07606626b6a5ef9d3ad318ef77eb51d0895d4
Opcode Fuzzy Hash: 2e46933e6f4de043fb6c14859512636f0fe02399f739e516c4fcfa2488e6e28b
Instruction Fuzzy Hash: C741E775B18A8281FB60DBA5E8717F92398EF9478CF440432EE9C67796DE3CE9418700

Function 00007FFD93B47830 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFD93B4786D
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFD93B47875
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD93B47888
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B47895
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FFD93B478A7
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFD93B478B9
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B478D8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B478F0
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B4790D

Strings

ssl_handshake_hash, xrefs: 00007FFD93B478E2
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B478E9

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_new$D_get_sizeDigestFinal_exR_set_debugX_copy_exX_freeX_get0_mdX_new
String ID: ..\s\ssl\ssl_lib.c$ssl_handshake_hash
API String ID: 474506514-3232504857
Opcode ID: 0d8cc38b9c04fce3ccfed6e37c47c93c2ac3590197e10c60dae3ca6581a8d782
Instruction ID: 0028468c252568900942d398af536bf8d90ad8f682c46ee93ebdb5448200cad2
Opcode Fuzzy Hash: 0d8cc38b9c04fce3ccfed6e37c47c93c2ac3590197e10c60dae3ca6581a8d782
Instruction Fuzzy Hash: A121A126F0C65391F630AAD3EC669BA6259AF54BCCF144031ED9D6B796DE3CE442C308

Function 00007FFD93B21019 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7575B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B75773
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7582D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B75845
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B75851
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B75869
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B758CF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B758E7

Strings

tls_parse_stoc_npn, xrefs: 00007FFD93B75760, 00007FFD93B75832, 00007FFD93B758D4
ssl_next_proto_validate, xrefs: 00007FFD93B75856
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93B7576C, 00007FFD93B7583E, 00007FFD93B75862, 00007FFD93B75893, 00007FFD93B758AA, 00007FFD93B758E0

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$ssl_next_proto_validate$tls_parse_stoc_npn
API String ID: 193678381-2899453981
Opcode ID: cddf7ad7604388b50a1bc70326a96001a4774d272c53461657fbd19596f1f40b
Instruction ID: 214c1db77dd2df4b1f36078247f3b7e82f612cd71a4f52c8e54f67576639f9fe
Opcode Fuzzy Hash: cddf7ad7604388b50a1bc70326a96001a4774d272c53461657fbd19596f1f40b
Instruction Fuzzy Hash: CB51E265B1968681FB609BA0E4357E923A8FF8478CF844036EACD27B95DF7CE1818750

Function 00007FFD939347D0 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD938CD940: memcpy.VCRUNTIME140 ref: 00007FFD938CDAE7

Part of subcall function 00007FFD938CD440: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD938C7857), ref: 00007FFD938CD59A
Part of subcall function 00007FFD938CD440: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD938C7857), ref: 00007FFD938CD617

memcpy.VCRUNTIME140 ref: 00007FFD93934B42

Strings

FILTER clause may only be used with aggregate window functions, xrefs: 00007FFD939348FF
L, xrefs: 00007FFD9393492D
RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression, xrefs: 00007FFD939348D4
ntile, xrefs: 00007FFD93934964
rank, xrefs: 00007FFD9393493C
percent_rank, xrefs: 00007FFD9393494E
lead, xrefs: 00007FFD9393496F
lag, xrefs: 00007FFD9393497A
dense_rank, xrefs: 00007FFD93934926
cume_dist, xrefs: 00007FFD93934959
row_number, xrefs: 00007FFD93934917

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: FILTER clause may only be used with aggregate window functions$L$RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression$cume_dist$dense_rank$lag$lead$ntile$percent_rank$rank$row_number
API String ID: 3510742995-2234786739
Opcode ID: f7a37864607f0b6ec54e289ffd9f03ce1b66eab8eb29475bb5620ccb49ccf488
Instruction ID: 6c80c86a0f1cf0e6a81618b3b62c763d264dadfda8bfcf842b0cb081360d189e
Opcode Fuzzy Hash: f7a37864607f0b6ec54e289ffd9f03ce1b66eab8eb29475bb5620ccb49ccf488
Instruction Fuzzy Hash: A8B18AB2B08B819AEB24CFA4D4603AE37B9EB49788F014235DA9C27789DB3DD554C744

Function 00007FFD93B55370 Relevance: 18.2, APIs: 12, Instructions: 177COMMON

Download Yara Rule

APIs

OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93B553A2
X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFD93B553EB
EVP_PKEY_get_security_bits.LIBCRYPTO-3 ref: 00007FFD93B553F8
X509_get_extension_flags.LIBCRYPTO-3 ref: 00007FFD93B5543D
X509_get_signature_info.LIBCRYPTO-3 ref: 00007FFD93B55462

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: L_sk_valueX509_get0_pubkeyX509_get_extension_flagsX509_get_signature_infoY_get_security_bits
String ID:
API String ID: 3095628011-0
Opcode ID: 6a90dacb690371e304f2445f9702f56de0f571147d6374ef0aa4f66c0045241f
Instruction ID: ee62d2811243466f2fef14695f3d8f25b4736cc6f3146d0eba322797fc83ced0
Opcode Fuzzy Hash: 6a90dacb690371e304f2445f9702f56de0f571147d6374ef0aa4f66c0045241f
Instruction Fuzzy Hash: DA519822B1C38242FA749AE2E4207BA61897FA479DF144136EDDF67BC5DE3CD5004700

Function 00007FFD93B22315 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B91187
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9119F
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B911C4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B911DC
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B91205
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9121D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B91253
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9126B

Strings

tls_process_change_cipher_spec, xrefs: 00007FFD93B9118C, 00007FFD93B911C9, 00007FFD93B9120A, 00007FFD93B91258
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93B91198, 00007FFD93B911D5, 00007FFD93B91216, 00007FFD93B91264

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_process_change_cipher_spec
API String ID: 193678381-3810074443
Opcode ID: 522da9b3beb261c0b84c81c1e5b9289c1f6ee77c1ef101be81f09331d13848a9
Instruction ID: 1a0461147b6ed1b393254fd82df66dceef3c2c68d36b004afa3d1074ab39b856
Opcode Fuzzy Hash: 522da9b3beb261c0b84c81c1e5b9289c1f6ee77c1ef101be81f09331d13848a9
Instruction Fuzzy Hash: 2141B176F0824692FBB5EBE1D4657F922A8EF9474CF444532CA8C636D1CF2CA581C314

Function 00007FFD938FD710 Relevance: 16.9, APIs: 2, Strings: 9, Instructions: 386COMMON

Download Yara Rule

Strings

no entry point [%s] in shared library [%s], xrefs: 00007FFD938FDBAC
unable to open shared library [%.*s], xrefs: 00007FFD938FDD1F
lib, xrefs: 00007FFD938FD961
%s.%s, xrefs: 00007FFD938FD7DC
sqlite3_, xrefs: 00007FFD938FD913
not authorized, xrefs: 00007FFD938FD783
error during initialization: %s, xrefs: 00007FFD938FDAD6
sqlite3_extension_init, xrefs: 00007FFD938FD79A
_init, xrefs: 00007FFD938FDA0E

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID:
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
API String ID: 0-3733955532
Opcode ID: b49e37c4812720664f40643c3e7dc813d78f1a620ad325e89548c25493480d3e
Instruction ID: 383b184a508c6bd084c4a7f356da5d98d2fe0b3efb0298d20bb7c5b10c30a17c
Opcode Fuzzy Hash: b49e37c4812720664f40643c3e7dc813d78f1a620ad325e89548c25493480d3e
Instruction Fuzzy Hash: 1C02A021B0DA8292EB759BA1A4643B963A8FF45B80F084535CE5E27799DF3DE948C340

Function 00007FFD93B5D2E0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B5B5F8), ref: 00007FFD93B5D327
BIO_puts.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B5B5F8), ref: 00007FFD93B5D33B
BIO_puts.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD93B5B5F8), ref: 00007FFD93B5D38B

Strings

extensions, length = %d, xrefs: 00007FFD93B5D3AC
extensions, extype = %d, extlen = %d, xrefs: 00007FFD93B5D450
No extensions, xrefs: 00007FFD93B5D331, 00007FFD93B5D381

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_puts$O_indent
String ID: No extensions$extensions, extype = %d, extlen = %d$extensions, length = %d
API String ID: 3358443131-3081145182
Opcode ID: c762ab333882584ce8f0169b4dba7062ddae6f5a73a86c39bcdf488755cf4005
Instruction ID: b479dc22d4c7c7d1d91777848419ac3c83c973ed4b139d129402c60d36700a4d
Opcode Fuzzy Hash: c762ab333882584ce8f0169b4dba7062ddae6f5a73a86c39bcdf488755cf4005
Instruction Fuzzy Hash: F441E2637186D18AD731DBA5E8205AAB7A9FB85798F488231EECC13B49DF3CE545C700

Function 00007FFD93B21375 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3 ref: 00007FFD93B51143
BIO_printf.LIBCRYPTO-3 ref: 00007FFD93B51173
BIO_puts.LIBCRYPTO-3 ref: 00007FFD93B51192
BIO_printf.LIBCRYPTO-3 ref: 00007FFD93B511C0
BIO_puts.LIBCRYPTO-3 ref: 00007FFD93B511DC

Strings

Master-Key:, xrefs: 00007FFD93B51188
%02X, xrefs: 00007FFD93B51169, 00007FFD93B511B6
RSA , xrefs: 00007FFD93B51125
Session-ID:, xrefs: 00007FFD93B51139

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_puts$O_printf
String ID: Master-Key:$%02X$RSA $Session-ID:
API String ID: 4098839300-1878088908
Opcode ID: fda8fcf2d81b2b0c740b8bfcb5be14cfd8bb3c30529b8a77aa9d5ac2da1480ae
Instruction ID: 9bd20dd9681bb397554391d58a39314b071fa71466906df0d96691fec28fbe5e
Opcode Fuzzy Hash: fda8fcf2d81b2b0c740b8bfcb5be14cfd8bb3c30529b8a77aa9d5ac2da1480ae
Instruction Fuzzy Hash: 1031D121B0CB8252FA709BD1DA60379676CEF4478CF448171EA8D62695CF2CE151C204

Function 00007FFD93B472F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93B4732B
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93B4733F

Part of subcall function 00007FFD93B45A60: OPENSSL_sk_pop_free.LIBCRYPTO-3(00000000,00007FFD93B3FE08), ref: 00007FFD93B45A81
Part of subcall function 00007FFD93B45A60: OPENSSL_sk_pop_free.LIBCRYPTO-3(00000000,00007FFD93B3FE08), ref: 00007FFD93B45A97
Part of subcall function 00007FFD93B45A60: X509_free.LIBCRYPTO-3(00000000,00007FFD93B3FE08), ref: 00007FFD93B45AA4

OPENSSL_sk_new_reserve.LIBCRYPTO-3 ref: 00007FFD93B47376
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B47387
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B4739F
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B473B0
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93B473C9

Strings

ssl_dane_dup, xrefs: 00007FFD93B4738C
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B47398

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: L_sk_numL_sk_pop_free$L_sk_new_reserveL_sk_valueR_newR_set_debugR_set_errorX509_free
String ID: ..\s\ssl\ssl_lib.c$ssl_dane_dup
API String ID: 641917998-780499551
Opcode ID: c2c7d87bce939961a0199c6e8bee7f3c77e2c972a0f7738d754dfb736ed6e270
Instruction ID: 09b9c4f3594c907339331478b137eea841743cfc093bec3a17606ce48d89cc2c
Opcode Fuzzy Hash: c2c7d87bce939961a0199c6e8bee7f3c77e2c972a0f7738d754dfb736ed6e270
Instruction Fuzzy Hash: AD31C236708B8282E770DBA5E4612AE666AFF84788F544036EECD93796DE3CD601C714

Function 00007FFD93B45670 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B456A5
ERR_new.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B456B2
ERR_set_debug.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B456CA
ERR_set_error.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B456DA
SCT_free.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B456E2
OPENSSL_sk_push.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B45715
OPENSSL_sk_pop.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B45723

Strings

ct_move_scts, xrefs: 00007FFD93B456B7
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B456C3

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: L_sk_new_nullL_sk_popL_sk_pushR_newR_set_debugR_set_errorT_free
String ID: ..\s\ssl\ssl_lib.c$ct_move_scts
API String ID: 678090195-2572802885
Opcode ID: e8f2d14d73432a17dfe26c064f1f3f55e634b60d6841f4f352f828a2021878d4
Instruction ID: 7acb615537392dc138f494de97854e6ff515bb53e8afafda62d156e1c98153c3
Opcode Fuzzy Hash: e8f2d14d73432a17dfe26c064f1f3f55e634b60d6841f4f352f828a2021878d4
Instruction Fuzzy Hash: A121A525B09B5282FA30EBA6E4300B96299AF9478CF544431EACD67BD6DE3CE8418704

Function 00007FFD93B21956 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD93B8F68C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B8F69D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B8F6B5
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FFD93B8F6E1
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B8F6EA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B8F702
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B8F723

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93B8F6AE, 00007FFD93B8F6FB
tls13_save_handshake_digest_for_pha, xrefs: 00007FFD93B8F6A2, 00007FFD93B8F6EF

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug$X_copy_exX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$tls13_save_handshake_digest_for_pha
API String ID: 401794203-262298153
Opcode ID: 24e92c9d1fa788a2a7cd987a161bfd58b78f247f229c5a50568caab08e5465c4
Instruction ID: 38d2522d763f3ddc502bbeeccdc60cafdf36a18fc3d856bb1fe630e3f7c21138
Opcode Fuzzy Hash: 24e92c9d1fa788a2a7cd987a161bfd58b78f247f229c5a50568caab08e5465c4
Instruction Fuzzy Hash: 26118E69F1964282FB70EBE1E875BF92358EF5478CF440131DA8C662E2EF3CA5818250

Function 00007FFD938BB0E0 Relevance: 15.3, APIs: 2, Strings: 8, Instructions: 330COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFD938BB1E3
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFD938BB2C4

Strings

zeroblob(%d), xrefs: 00007FFD938BB480
%!.15g, xrefs: 00007FFD938BB39E
%02x, xrefs: 00007FFD938BB4E4
-- , xrefs: 00007FFD938BB173, 00007FFD938BB192
%lld, xrefs: 00007FFD938BB381
'%.*q', xrefs: 00007FFD938BB435
NULL, xrefs: 00007FFD938BB34D
?, xrefs: 00007FFD938BB2D8

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$zeroblob(%d)
API String ID: 3510742995-875588658
Opcode ID: ca846c7505aeaa6bd30d3d42dfc0cdd5eeef11c82f0aefe9c9613a625e444ecc
Instruction ID: 36490058bbacbd888140aaa28eb9289bb1631fc062d0314cb04c26fa4989f064
Opcode Fuzzy Hash: ca846c7505aeaa6bd30d3d42dfc0cdd5eeef11c82f0aefe9c9613a625e444ecc
Instruction Fuzzy Hash: E6E18F62F086578AFB32CBB4D4603BC27F9AB44788F404136DE5E76A99DE3DA545C380

Function 00007FFD938D7830 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 327COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938D7BA2

Strings

Cannot add a UNIQUE column, xrefs: 00007FFD938D796C
SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE, xrefs: 00007FFD938D7D2C
Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFD938D79DF
Cannot add a PRIMARY KEY column, xrefs: 00007FFD938D7951
Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFD938D79BD
SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFD938D79C7, 00007FFD938D7A43, 00007FFD938D7B51
UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFD938D7BE4
cannot add a STORED column, xrefs: 00007FFD938D7B42
Cannot add a column with non-constant default, xrefs: 00007FFD938D7A39

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
API String ID: 3510742995-200680935
Opcode ID: de498d8ebdc1d8b11aa5bcc87f253d03924d12926c0a2cf90f6d28e521af2e8d
Instruction ID: d3da6761a2d0a7f729fda485a877917a98448184167eead3325a1423274b2541
Opcode Fuzzy Hash: de498d8ebdc1d8b11aa5bcc87f253d03924d12926c0a2cf90f6d28e521af2e8d
Instruction Fuzzy Hash: B9E1BF22B08B8285EB348F95A5647B963A9FB44BC4F540331EEAD27799DF3EE541C300

Function 00007FFD938909E0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON

Download Yara Rule

APIs

new[].MSPDB140-MSVCRT ref: 00007FFD93890AF7

Strings

:, xrefs: 00007FFD93890A4C
?, xrefs: 00007FFD93890A21
\, xrefs: 00007FFD93890A68
winFullPathname1, xrefs: 00007FFD93890ADC
winFullPathname2, xrefs: 00007FFD93890B65
%s%c%s, xrefs: 00007FFD93890A56
:, xrefs: 00007FFD93890A11

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: new[]
String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
API String ID: 4059295235-3840279414
Opcode ID: 95529dcaa0ae4f9f9b80e21f1a4713639f067412f55fc70f80a129abc63d2c98
Instruction ID: 54ade58ad5500790dd226b0899677a42b93ae1880bd1a4d13d68c08fb0763835
Opcode Fuzzy Hash: 95529dcaa0ae4f9f9b80e21f1a4713639f067412f55fc70f80a129abc63d2c98
Instruction Fuzzy Hash: 41513B91F1C28246FB759BE1A4356BA6BD9AF84B88F084035DE4D37786CF3DE8498341

Function 00007FFD93B8D450 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FFD93B8F905), ref: 00007FFD93B8D55B
BIO_ctrl.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B8F905), ref: 00007FFD93B8D581
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B8F905), ref: 00007FFD93B8D58A
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93B8F905), ref: 00007FFD93B8D5A2

Strings

TLS 1.3, client CertificateVerify, xrefs: 00007FFD93B8D4C9
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93B8D59B
get_cert_verify_tbs_data, xrefs: 00007FFD93B8D58F
TLS 1.3, server CertificateVerify, xrefs: 00007FFD93B8D4F1

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_ctrlR_newR_set_debugmemcpy
String ID: ..\s\ssl\statem\statem_lib.c$TLS 1.3, client CertificateVerify$TLS 1.3, server CertificateVerify$get_cert_verify_tbs_data
API String ID: 152836652-3760622993
Opcode ID: 05f68823373f23e9663de47f1c69a2da06f222f5d74598419237d48ab8bc82a0
Instruction ID: 91e4a98f88b231f1adf141f4f5eb5f15f5ce29c5e1a1a35e7b30968132eb0a84
Opcode Fuzzy Hash: 05f68823373f23e9663de47f1c69a2da06f222f5d74598419237d48ab8bc82a0
Instruction Fuzzy Hash: 8A41C362B0968283E760CB54D4606BD77A8FB95B8CF548137DACCA7A91DF3CE591C300

Function 00007FFD93B21686 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B91819
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B91831
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B91870
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B91888

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93B9182A, 00007FFD93B91881, 00007FFD93B918C6
tls_process_key_update, xrefs: 00007FFD93B9181E, 00007FFD93B91875, 00007FFD93B918BA

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_process_key_update
API String ID: 193678381-597347991
Opcode ID: 29c723160eaeccd918e91a572f20d26d1d019dcd008e3f0eb2bd94873a2d9714
Instruction ID: dce2325e959fedd8cc92b458d5b9ceb4e02be552a3d3142c0c6bab92edb4773c
Opcode Fuzzy Hash: 29c723160eaeccd918e91a572f20d26d1d019dcd008e3f0eb2bd94873a2d9714
Instruction Fuzzy Hash: 3921D165F0864351FB34DBA2E8B06BE226DAF8438CF548132DA8D637D6DF2CE9519340

Function 00007FFD93B21627 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93B43800
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93B43815
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93B4382E

Strings

SSL_set_cipher_list, xrefs: 00007FFD93B43855
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B43861

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: L_sk_num$L_sk_value
String ID: ..\s\ssl\ssl_lib.c$SSL_set_cipher_list
API String ID: 1603723057-1252523853
Opcode ID: 0cdc888642a4c7ec4b4db4ee68f31cf0bed92deb90d71d28f91530e20ff43650
Instruction ID: a6efb42d5b74cf31a255281e32e3978c3ad226ee5d46fe8a9e4e17e4e0629ed8
Opcode Fuzzy Hash: 0cdc888642a4c7ec4b4db4ee68f31cf0bed92deb90d71d28f91530e20ff43650
Instruction Fuzzy Hash: BD21CB26B1965182E720AB55E4602F963A8EF8878CF580035DBCC57792DF3DD5428B04

Function 00007FFD93B21C2B Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B61125
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B6113D
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B6114E
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B6116D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B61185
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B61196

Strings

SSL_CTX_set_client_cert_engine, xrefs: 00007FFD93B6112A, 00007FFD93B61172
..\s\ssl\tls_depr.c, xrefs: 00007FFD93B61136, 00007FFD93B6117E

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\tls_depr.c$SSL_CTX_set_client_cert_user
API String ID: 1552677711-2801407537
Opcode ID: dd8926da48fe554bf7bef03d4ee45b681770d80b6e123e6bbc4578b5fef0e44d
Instruction ID: 0c5d6c9d8ea13a7798e9d0445701abe684629342f8c3aa2046825f6a806a8887
Opcode Fuzzy Hash: dd8926da48fe554bf7bef03d4ee45b681770d80b6e123e6bbc4578b5fef0e44d
Instruction Fuzzy Hash: 59119125F2C14252F7A4E7A4E9717FA2269AF4838CF945030E98DA2AD7DE3CE5508705

Function 00007FFD93B451A0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B42D97), ref: 00007FFD93B451CE
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B42D97), ref: 00007FFD93B451E6
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B42D97), ref: 00007FFD93B451F7
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B42D97), ref: 00007FFD93B45210
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B42D97), ref: 00007FFD93B45228
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93B42D97), ref: 00007FFD93B45239

Strings

can_renegotiate, xrefs: 00007FFD93B451D3, 00007FFD93B45215
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B451DF, 00007FFD93B45221

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$can_renegotiate
API String ID: 1552677711-3796731956
Opcode ID: ffee28e96335aa704968abb80b6c1ed724ff21ba08e802f7bdb6329489e06ba8
Instruction ID: 811fce9c1851988f45bcbc579e0e2a2a5850f68b9bd82bfdb6e0a53c03906b1f
Opcode Fuzzy Hash: ffee28e96335aa704968abb80b6c1ed724ff21ba08e802f7bdb6329489e06ba8
Instruction Fuzzy Hash: 0E11D665F1914743F764E7A4D8767EE2258EB5070CFD04032E28C926E2CE3CEA85C605

Function 00007FFD938C2BB0 Relevance: 14.0, APIs: 1, Strings: 8, Instructions: 489COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD938C2C7C

Strings

foreign key, xrefs: 00007FFD938C2E53
cannot open %s column for writing, xrefs: 00007FFD938C31B4
cannot open table without rowid: %s, xrefs: 00007FFD938C31F8
cannot open virtual table: %s, xrefs: 00007FFD938C3201
no such column: "%s", xrefs: 00007FFD938C31E6
cannot open view: %s, xrefs: 00007FFD938C31EF
indexed, xrefs: 00007FFD938C2EA0
out of memory, xrefs: 00007FFD938C2CE8

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"$out of memory
API String ID: 2221118986-554953066
Opcode ID: 40f90b253be70af58b183e7cc01e3840ada6dd89adfd0aa5533fba491ad6c919
Instruction ID: c01d58f6739d3e8c384306cfa407b3cbefbf827ef8baf7970f63984c500f12ce
Opcode Fuzzy Hash: 40f90b253be70af58b183e7cc01e3840ada6dd89adfd0aa5533fba491ad6c919
Instruction Fuzzy Hash: F332BC72B08B8186EB74EFA9D4607A937A8FB48B88F404136DE4D67795DF3AE451C700

Function 00007FFD93B453F0 Relevance: 13.6, APIs: 9, Instructions: 75COMMON

Download Yara Rule

APIs

d2i_OCSP_RESPONSE.LIBCRYPTO-3 ref: 00007FFD93B45444
OCSP_response_get1_basic.LIBCRYPTO-3 ref: 00007FFD93B45454
OCSP_resp_count.LIBCRYPTO-3 ref: 00007FFD93B4546B
OCSP_resp_get0.LIBCRYPTO-3 ref: 00007FFD93B45479
OCSP_SINGLERESP_get1_ext_d2i.LIBCRYPTO-3 ref: 00007FFD93B45491

Part of subcall function 00007FFD93B45670: OPENSSL_sk_new_null.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B456A5
Part of subcall function 00007FFD93B45670: ERR_new.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B456B2
Part of subcall function 00007FFD93B45670: ERR_set_debug.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B456CA
Part of subcall function 00007FFD93B45670: ERR_set_error.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B456DA
Part of subcall function 00007FFD93B45670: SCT_free.LIBCRYPTO-3(?,00007FFD93B40C79), ref: 00007FFD93B456E2

OCSP_resp_count.LIBCRYPTO-3 ref: 00007FFD93B454B9
SCT_LIST_free.LIBCRYPTO-3 ref: 00007FFD93B454CA
OCSP_BASICRESP_free.LIBCRYPTO-3 ref: 00007FFD93B454D2
OCSP_RESPONSE_free.LIBCRYPTO-3 ref: 00007FFD93B454DA

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: P_resp_countT_free$E_freeL_sk_new_nullP_freeP_get1_ext_d2iP_resp_get0P_response_get1_basicR_newR_set_debugR_set_errord2i_
String ID:
API String ID: 2730705051-0
Opcode ID: 0e7fa4a51d6b1f64f47392326b463c9cfd1bb6ecd7d7e87c3f01f1a2ef2afe8b
Instruction ID: b7c77cea53641698f9deba0df91825262a8522c3539da3161927b71dc23f8b8f
Opcode Fuzzy Hash: 0e7fa4a51d6b1f64f47392326b463c9cfd1bb6ecd7d7e87c3f01f1a2ef2afe8b
Instruction Fuzzy Hash: 2521C411B0DB5241E971A6D7E4B56791688AF89BCCF04043AEECD6BBC7EE6CD8028740

Function 00007FFD93887621 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 429COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93887B28

Strings

-Inf, xrefs: 00007FFD938877F4
0123456789ABCDEF0123456789abcdef, xrefs: 00007FFD93887A2C
NaN, xrefs: 00007FFD93887708
gfff, xrefs: 00007FFD93887A7D
null, xrefs: 00007FFD9388770F
-, xrefs: 00007FFD93887833
VUUU, xrefs: 00007FFD938878BA

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memset
String ID: -$-Inf$0123456789ABCDEF0123456789abcdef$NaN$VUUU$gfff$null
API String ID: 2221118986-3207396689
Opcode ID: 9a9d10f77effef2898004934f6e42a391665c3e4f244e9424481abab3c511108
Instruction ID: 2035f8af1916a5e5a01d6fc632cc29240c20edb458c4bc209213cadcc0b89ac9
Opcode Fuzzy Hash: 9a9d10f77effef2898004934f6e42a391665c3e4f244e9424481abab3c511108
Instruction Fuzzy Hash: 6F023662B1C28247F735CBA995A077E6BF9EB51344F094135EAAE676C1CE3EE841C700

Function 00007FFD938E2140 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 414COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938E21DA

Strings

sqlite_temp_master, xrefs: 00007FFD938E2199, 00007FFD938E229D
table, xrefs: 00007FFD938E2275
there is already an index named %s, xrefs: 00007FFD938E23EE
temporary table name must be unqualified, xrefs: 00007FFD938E220E
view, xrefs: 00007FFD938E226E, 00007FFD938E2384
%s %T already exists, xrefs: 00007FFD938E237D
sqlite_master, xrefs: 00007FFD938E215F, 00007FFD938E22C2, 00007FFD938E2614

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: %s %T already exists$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3510742995-2846519077
Opcode ID: 12690901e8617ce6e03cc79fd080018a6e8a06bda0edbef8401b5ae80958ff42
Instruction ID: 37c357ee8685745f30df661a16d883ff8095106cf6097a9b378d0a5ea321468c
Opcode Fuzzy Hash: 12690901e8617ce6e03cc79fd080018a6e8a06bda0edbef8401b5ae80958ff42
Instruction Fuzzy Hash: 9302CD62B0878286EB38EF6194207BA37A9FB84B84F004235DE8D27795DF3EE5518740

Function 00007FFD93B956D0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B95713
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9572B

Strings

ssl_check_srp_ext_ClientHello, xrefs: 00007FFD93B95718, 00007FFD93B9576E
p, xrefs: 00007FFD93B956E9
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93B95724, 00007FFD93B9577A

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$p$ssl_check_srp_ext_ClientHello
API String ID: 193678381-2953162070
Opcode ID: a724ffa4adbff50ed23554cac04d888e0867ab1b44ce4ea7118337f94584a7b0
Instruction ID: c1f7c9c5a1c5649fd90d444d8abc8413bfc489a3e2f0c6d346bbc0c6920166a7
Opcode Fuzzy Hash: a724ffa4adbff50ed23554cac04d888e0867ab1b44ce4ea7118337f94584a7b0
Instruction Fuzzy Hash: 2121E462F1914282FB70A7A4E8657B92258EF9071CF980132E99C966E2DF2CE985C700

Function 00007FFD93B2237E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B75643
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7565B
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B75696
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B756A2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B756BA

Strings

tls_parse_stoc_maxfragmentlen, xrefs: 00007FFD93B7564D, 00007FFD93B756A7
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93B75654, 00007FFD93B756B3

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_parse_stoc_maxfragmentlen
API String ID: 476316267-2494698823
Opcode ID: d8a5845e12814c52d556ae87b962f841879b70cfb8b58c889c854b5485bc3b70
Instruction ID: d0dd9a40a9c7354a8aa045b85420a07065de32fdb9b0379f48d61f7a5f4db1c5
Opcode Fuzzy Hash: d8a5845e12814c52d556ae87b962f841879b70cfb8b58c889c854b5485bc3b70
Instruction Fuzzy Hash: 9E11E9A1F0858281F7709BE0D8716F92358EF40748F944432DA8D237D2DE2CEAD1C714

Function 00007FFD93B8D835 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

OPENSSL_sk_new.LIBCRYPTO-3 ref: 00007FFD93B8D86C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B8D87B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B8D893
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFD93B8D95E
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93B8D97A
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93B8DA5A
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFD93B8DA62

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93B8D88C
parse_ca_names, xrefs: 00007FFD93B8D885

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: L_sk_pop_free$E_freeL_sk_newL_sk_pushR_newR_set_debugX509_
String ID: ..\s\ssl\statem\statem_lib.c$parse_ca_names
API String ID: 3454744561-1744826974
Opcode ID: 04ddb308f44a95e164a7bc128782d027c77922fadf66ae16df02d4ebe5c69b21
Instruction ID: fd1921f568ae4ed5e2565d6731752912b97723c07ec82b336e34f7b91bcff3e6
Opcode Fuzzy Hash: 04ddb308f44a95e164a7bc128782d027c77922fadf66ae16df02d4ebe5c69b21
Instruction Fuzzy Hash: 7E01F11AB0D64251FA60ABA6FC315EB6268AF887CCF444432EDCC13B92DE3CE1068200

Function 00007FFD938D8CE0 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 298COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD938D8E0F
memset.VCRUNTIME140 ref: 00007FFD938D8EC9
memcpy.VCRUNTIME140 ref: 00007FFD938D8EED
memcpy.VCRUNTIME140 ref: 00007FFD938D8FC9
memmove.VCRUNTIME140 ref: 00007FFD938D90AA
memcpy.VCRUNTIME140 ref: 00007FFD938D90CB

Strings

%Q%s, xrefs: 00007FFD938D9034
"%w" , xrefs: 00007FFD938D8D8B

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy$memset$memmove
String ID: "%w" $%Q%s
API String ID: 3094553269-1987291987
Opcode ID: 092ca3966ab74f879dfa7942666e78d1bf51f37c593a3aa46a3b99905dea5e2b
Instruction ID: 897f21b3c836928df0b554e335e79ace3c82a369c0a5854c7c297e42c774cd8d
Opcode Fuzzy Hash: 092ca3966ab74f879dfa7942666e78d1bf51f37c593a3aa46a3b99905dea5e2b
Instruction Fuzzy Hash: 74C1E162B08B8286EA34CB95A4A037A67A5FB45BA0F044735DE7E277D5CF3DE841C700

Function 00007FFD93B457A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93B457C3
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93B457D5
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B457ED
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B45805
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B45816

Strings

ct_strict, xrefs: 00007FFD93B457F2
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B457FE

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: L_sk_numL_sk_valueR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ct_strict
API String ID: 2392307641-4060112342
Opcode ID: 4533c9fab320a86e9a286d2274cf84dd3800ab5d49d8415c502bd591c6c9f230
Instruction ID: 4e6df96643af9300845b944b79805fb88c8ff93dc538da04a22f32fc48945023
Opcode Fuzzy Hash: 4533c9fab320a86e9a286d2274cf84dd3800ab5d49d8415c502bd591c6c9f230
Instruction Fuzzy Hash: 93012629F1C64252F7A4A7A5F0B11B91258EF843CCFA48031F98D63BD6DE3CD9818304

Function 00007FFD93B2263F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

EVP_PKEY_get_security_bits.LIBCRYPTO-3 ref: 00007FFD93B430AC
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B430CD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B430E5
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B430F6
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93B43113

Strings

SSL_set0_tmp_dh_pkey, xrefs: 00007FFD93B430D2
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B430DE

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_freeY_get_security_bits
String ID: ..\s\ssl\ssl_lib.c$SSL_set0_tmp_dh_pkey
API String ID: 2486296959-3900076315
Opcode ID: 0663dbe0d9e2f24b4d42b00f9c6a5dfd65e6da1202bfe41ae48a83f1b03d5ee1
Instruction ID: e93828f88daf81179c0c115fb8855ddad67b34fbfa8f800de27623ca205e0d33
Opcode Fuzzy Hash: 0663dbe0d9e2f24b4d42b00f9c6a5dfd65e6da1202bfe41ae48a83f1b03d5ee1
Instruction Fuzzy Hash: 6A01D626B1864142E760E761F9616BD62A8EF857CCF544031EE8C57BA6DE3CD5408704

Function 00007FFD938A0FF0 Relevance: 12.3, APIs: 5, Strings: 3, Instructions: 253COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938A12C7
memcpy.VCRUNTIME140 ref: 00007FFD938A1335

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938A1072
database corruption, xrefs: 00007FFD938A107E
%s at line %d of [%.10s], xrefs: 00007FFD938A108A

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: 631cb78d0e6fe1cfa956d85cb5f3c50174a7640773ae2e83a94a1fd57775438d
Instruction ID: 3703b92c078c9ad62bef8c87ddf60542edabbfa24ee6ed9d9300f9750cf5bc72
Opcode Fuzzy Hash: 631cb78d0e6fe1cfa956d85cb5f3c50174a7640773ae2e83a94a1fd57775438d
Instruction Fuzzy Hash: B7B10772B0C2D195D734CBA994A46BE7BAAFB80780F044236DB8A97781DE3DE545C720

Function 00007FFD93B21D20 Relevance: 12.1, APIs: 8, Instructions: 144COMMON

Download Yara Rule

APIs

ERR_peek_error.LIBCRYPTO-3 ref: 00007FFD93B41273

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_peek_error
String ID:
API String ID: 3623038435-0
Opcode ID: 2373404f7a23302672f0e1150443048c75d459f2b6909c1f285500e66c3becf1
Instruction ID: c3b4ab3793d7c67401e9b3ecb7c0b7c1bb94cb767c988fcee6aae9ae738eec01
Opcode Fuzzy Hash: 2373404f7a23302672f0e1150443048c75d459f2b6909c1f285500e66c3becf1
Instruction Fuzzy Hash: 0741A662F1C24292FB748696C16533D2299EF8579CF586030EE8DA7BC5EF1CE9D18708

Function 00007FFD93B252E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

BIO_get_data.LIBCRYPTO-3 ref: 00007FFD93B2532D
BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFD93B25340
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFD93B25385
BIO_set_retry_reason.LIBCRYPTO-3 ref: 00007FFD93B25425

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_clear_flagsO_get_dataO_set_flagsO_set_retry_reason
String ID:
API String ID: 3836630899-0
Opcode ID: e03d538e60a270bb7c9e6b1dbca698f7b36a3815dcc41f1296a6c0701146d666
Instruction ID: ad46d8077b8e540310c33bf3baf1b0b19151f7f3c5fef23dc196815c17af6ea6
Opcode Fuzzy Hash: e03d538e60a270bb7c9e6b1dbca698f7b36a3815dcc41f1296a6c0701146d666
Instruction Fuzzy Hash: 7141E922F0821242E774AFA6E52067DE295EF90BDCF404132DDAD57B8ECE3CE8418644

Function 00007FFD93892C90 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 339COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD9389304A

Strings

API called with finalized prepared statement, xrefs: 00007FFD93892E0C, 00007FFD93892E88
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD93892D03, 00007FFD93892E99
API called with NULL prepared statement, xrefs: 00007FFD93892DF4
misuse, xrefs: 00007FFD93892E39, 00007FFD93892EA6
%s at line %d of [%.10s], xrefs: 00007FFD93892E45, 00007FFD93892EB2
ATTACH x AS %Q, xrefs: 00007FFD93892D20

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$misuse
API String ID: 3510742995-1404302391
Opcode ID: ef97a992b7bd2d601b476a99fa21004acb54b4b392abf00235d64f695c1b2843
Instruction ID: 238aa39591daa20b9f3e0904d987370d75e3c94fd677d29a9e0c418c1fb5682e
Opcode Fuzzy Hash: ef97a992b7bd2d601b476a99fa21004acb54b4b392abf00235d64f695c1b2843
Instruction Fuzzy Hash: 3FF19B25B0DB4696FA789BA5A8643793BADFF84B84F040135DE4E277A1CF3EE4458300

Function 00007FFD939044F0 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 334COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93904679

Strings

sqlite_temp_master, xrefs: 00007FFD93904535
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 00007FFD9390486F
table, xrefs: 00007FFD9390451A
CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text), xrefs: 00007FFD93904594
ase, xrefs: 00007FFD9390477D
sqlite_master, xrefs: 00007FFD9390453C

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
API String ID: 3510742995-879093740
Opcode ID: 47c58cd30b5c800cc8f44381aaae0144bdbb34a6b14d1da333cb0fe74ad5111a
Instruction ID: ca441f71027f62f8cc6a29f8ba50fe3d955002bcbf859515103e14f08c8d6a02
Opcode Fuzzy Hash: 47c58cd30b5c800cc8f44381aaae0144bdbb34a6b14d1da333cb0fe74ad5111a
Instruction Fuzzy Hash: D3E1D326F08791A6FB20DBA9C1603BE27A9FB45B88F054235CE5C27791DF38E851C740

Function 00007FFD93B5B2B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFD93B5B2FD
BIO_printf.LIBCRYPTO-3 ref: 00007FFD93B5B347

Strings

%s=0x%x (%s), xrefs: 00007FFD93B5B340
UNKNOWN, xrefs: 00007FFD93B5B321
server_version, xrefs: 00007FFD93B5B336
cookie, xrefs: 00007FFD93B5B374

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s=0x%x (%s)$UNKNOWN$cookie$server_version
API String ID: 1860387303-3219550004
Opcode ID: 64ca8e15f2fd70a2bc7e9583ff755a23efd2fa34a0515b12eecb7d8ed4e3806f
Instruction ID: 47da39ac95b202dc64ba6f22cf8995d1d720795e02462b72dc096a42e1e1bc15
Opcode Fuzzy Hash: 64ca8e15f2fd70a2bc7e9583ff755a23efd2fa34a0515b12eecb7d8ed4e3806f
Instruction Fuzzy Hash: F1216D22B18B9186E7308BD1E4610BAB7A9FB65788F844532EACC23B65DF7CD601C700

Function 00007FFD93B61454 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

EC_KEY_get0_group.LIBCRYPTO-3 ref: 00007FFD93B6147C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B61486
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B6149E
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B614AF

Strings

ssl_set_tmp_ecdh_groups, xrefs: 00007FFD93B6148B
..\s\ssl\tls_depr.c, xrefs: 00007FFD93B61497

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_get0_group
String ID: ..\s\ssl\tls_depr.c$ssl_set_tmp_ecdh_groups
API String ID: 2690379533-3926364423
Opcode ID: 68489a538686b752c9f2948f9d1530e8915f1fc4dfe4fbf8939f8a3c3b18f5ad
Instruction ID: e838f0055bdf9b998c82f4d540f62191db76fbbff358aefdf8faba78b3774543
Opcode Fuzzy Hash: 68489a538686b752c9f2948f9d1530e8915f1fc4dfe4fbf8939f8a3c3b18f5ad
Instruction Fuzzy Hash: 5FF02765F1814262E7A0E7E1E8317F932699F5C38CFA00031E58C53BD7EE3CDA404601

Function 00007FFD938E6750 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 338COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD938E689B
memcpy.VCRUNTIME140 ref: 00007FFD938E68E2
memcpy.VCRUNTIME140 ref: 00007FFD938E6B6E

Strings

foreign key on %s should reference only one column of table %T, xrefs: 00007FFD938E67D5
unknown column "%s" in foreign key definition, xrefs: 00007FFD938E6AFE
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFD938E67FE

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 438689982-272990098
Opcode ID: 179228fa32d4bbaca882792da681e0bf14f41731769919f3c169151cb8f9c1e0
Instruction ID: aa276a81f9988c2d34935524f63705561f88a166a6cf8e2960f9194302d84bb3
Opcode Fuzzy Hash: 179228fa32d4bbaca882792da681e0bf14f41731769919f3c169151cb8f9c1e0
Instruction Fuzzy Hash: EAD122A2F0978282EB38EB9590646B97BA9FB81BD4F144132DE5D23785CF3EE441C300

Function 00007FFD938D0800 Relevance: 9.3, APIs: 2, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

REUSE SUBQUERY %d, xrefs: 00007FFD938D0846
CORRELATED , xrefs: 00007FFD938D08D8
Expression tree is too large (maximum depth %d), xrefs: 00007FFD938D0C07
%sSCALAR SUBQUERY %d, xrefs: 00007FFD938D08E2

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID:
String ID: %sSCALAR SUBQUERY %d$CORRELATED $Expression tree is too large (maximum depth %d)$REUSE SUBQUERY %d
API String ID: 0-875495356
Opcode ID: 4eb44bfa136c71ea24a0bc3a08963b76a613e18306c8ed6202d24815c66bb443
Instruction ID: 9f5a220a8d04e709a61d90acfbd43d61cee6c814a289b8be44187da45e2d9e7f
Opcode Fuzzy Hash: 4eb44bfa136c71ea24a0bc3a08963b76a613e18306c8ed6202d24815c66bb443
Instruction Fuzzy Hash: 9BE1DE72B187828BE360CF65E8603AA77A4FB89784F048235DB9D57B95DF39E491C700

Function 00007FFD938A55B0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD938A577D
memcpy.VCRUNTIME140 ref: 00007FFD938A5965
memcpy.VCRUNTIME140 ref: 00007FFD938A597A

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938A55F5
database corruption, xrefs: 00007FFD938A5601
%s at line %d of [%.10s], xrefs: 00007FFD938A560D

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy$memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 438689982-3727861699
Opcode ID: f3ad3245a8a2ed449686766016360017ca86d182d870b3dd7fec9afb85a1be22
Instruction ID: 5493b211ea1465548c30a0553b3d4ba5a3441edf86b52703ab5f15816208d154
Opcode Fuzzy Hash: f3ad3245a8a2ed449686766016360017ca86d182d870b3dd7fec9afb85a1be22
Instruction Fuzzy Hash: 11D1BD72B0868586DB60CF99E0507AEB3A9FB84B84F554032DE8DA7754EF3AD881C710

Function 00007FFD938A92A0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 217COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFD938A935B
memmove.VCRUNTIME140 ref: 00007FFD938A93ED
memmove.VCRUNTIME140 ref: 00007FFD938A946C

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938A931D
database corruption, xrefs: 00007FFD938A9329
%s at line %d of [%.10s], xrefs: 00007FFD938A9335

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2162964266-3727861699
Opcode ID: aa1e37c07d941f3c4ed7c5966c80035fc97b348be009f1c7a09fa429dc4ea9c6
Instruction ID: 59ec50f49e9b46780ea2a28f8d94bc1c46af47ef7dccb9ac62b95206a3c654c7
Opcode Fuzzy Hash: aa1e37c07d941f3c4ed7c5966c80035fc97b348be009f1c7a09fa429dc4ea9c6
Instruction Fuzzy Hash: FB91E162B086C986CB30CBA5E4902AEBBA9FB45B84F444532DF8D93B45DF3DD255CB10

Function 00007FFD938D7D70 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD938D7F34
memcpy.VCRUNTIME140 ref: 00007FFD938D7F7E
memcpy.VCRUNTIME140 ref: 00007FFD938D7FE9

Strings

virtual tables may not be altered, xrefs: 00007FFD938D7E08
Cannot add a column to a view, xrefs: 00007FFD938D7E24
sqlite_altertab_%s, xrefs: 00007FFD938D7F3D

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy$memset
String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
API String ID: 438689982-2063813899
Opcode ID: 05e9074ce7d3fd9ce95b34b1dd680a5b2169618f2d1bdf2c15a83bc87b963f18
Instruction ID: b5ff6408d3670d505521be4cdb39c938d24e8e5e745360134ebaa1a446ad2179
Opcode Fuzzy Hash: 05e9074ce7d3fd9ce95b34b1dd680a5b2169618f2d1bdf2c15a83bc87b963f18
Instruction Fuzzy Hash: A691A162B09B8182EB60DF91A4242B977A9FB88B80F494335DFAD57785DF3DE851C300

Function 00007FFD938A8670 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938A882C
memmove.VCRUNTIME140 ref: 00007FFD938A8864
memcpy.VCRUNTIME140 ref: 00007FFD938A8931

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938A870C
database corruption, xrefs: 00007FFD938A871F
%s at line %d of [%.10s], xrefs: 00007FFD938A8726

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy$memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 1283327689-3727861699
Opcode ID: 8de5f6cd6f6e33fde0b1876390d4153991315e8dec9b2e074adf9944a97a2060
Instruction ID: 9704abdf923f25067df79f5c60993577dc599620482c4c350dd88d9a48df5085
Opcode Fuzzy Hash: 8de5f6cd6f6e33fde0b1876390d4153991315e8dec9b2e074adf9944a97a2060
Instruction Fuzzy Hash: CF910362B082D196D724CB66C5A02BD7BE8FB40B41F488036DB8D97785DF3DE856C720

Function 00007FFD938B8F80 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 139COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-8000000000000000,?,00000000,00007FFD938FD1A0), ref: 00007FFD938B911D

Strings

API called with finalized prepared statement, xrefs: 00007FFD938B8FAC
8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938B8FCA
API called with NULL prepared statement, xrefs: 00007FFD938B8F94
misuse, xrefs: 00007FFD938B8FD7
%s at line %d of [%.10s], xrefs: 00007FFD938B8FE3

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$API called with NULL prepared statement$API called with finalized prepared statement$misuse
API String ID: 3510742995-3538577999
Opcode ID: 86f219e71f00a271b4cc23a0aadb4efffd5b7d5429c326e173fb0e6050e0a240
Instruction ID: 9285df8629e5f121abdd70b430172a6493f10b653915f74e385fc62147d5fbb5
Opcode Fuzzy Hash: 86f219e71f00a271b4cc23a0aadb4efffd5b7d5429c326e173fb0e6050e0a240
Instruction Fuzzy Hash: F151E321B0E68382FA349BD5943027963BAAF40B90F044935DE5D6B3C5DE3EE8468380

Function 00007FFD93B55160 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFD93B551B3
EVP_PKEY_get_security_bits.LIBCRYPTO-3 ref: 00007FFD93B551C0
X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFD93B55202
EVP_PKEY_get_security_bits.LIBCRYPTO-3 ref: 00007FFD93B5520F
X509_get_extension_flags.LIBCRYPTO-3 ref: 00007FFD93B55253
X509_get_signature_info.LIBCRYPTO-3 ref: 00007FFD93B55283

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: X509_get0_pubkeyY_get_security_bits$X509_get_extension_flagsX509_get_signature_info
String ID:
API String ID: 3836818763-0
Opcode ID: 881e7ae5a45f0a571fb5a722c38be3c32f9cab0c888addf428be226d2df2081b
Instruction ID: d2200deea06117c926bfddfbd5b7dda3872798c12aeb237ab19792e46bccd8c8
Opcode Fuzzy Hash: 881e7ae5a45f0a571fb5a722c38be3c32f9cab0c888addf428be226d2df2081b
Instruction Fuzzy Hash: 5B418721F0C38245FA74AAD1E421BBA6648BFA478DF544536EDCE6BB86DF3DE4418700

Function 00007FFD93B216EA Relevance: 9.1, APIs: 6, Instructions: 63COMMON

Download Yara Rule

APIs

BIO_next.LIBCRYPTO-3 ref: 00007FFD93B43650
BIO_up_ref.LIBCRYPTO-3 ref: 00007FFD93B4366D
BIO_next.LIBCRYPTO-3 ref: 00007FFD93B43681
BIO_next.LIBCRYPTO-3 ref: 00007FFD93B4369A
BIO_free_all.LIBCRYPTO-3 ref: 00007FFD93B436AE
BIO_free_all.LIBCRYPTO-3 ref: 00007FFD93B436CB

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_next$O_free_all$O_up_ref
String ID:
API String ID: 1216991848-0
Opcode ID: 0aa353734cd2757dcafc435e18f9e496c362ffaffce6a2e2fac3e9d2a8b7e651
Instruction ID: 339d55ddd581586a97a0d0250e6dbef42315eff1c141bd3b628271fc9b5d6eca
Opcode Fuzzy Hash: 0aa353734cd2757dcafc435e18f9e496c362ffaffce6a2e2fac3e9d2a8b7e651
Instruction Fuzzy Hash: 42214F16B0E64281EEB4AF95E1650785368FF54FCCF580531EADD27B9ACE38E8618704

Function 00007FFD93B45320 Relevance: 9.0, APIs: 6, Instructions: 33COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-3(?,00007FFD93B3F27A), ref: 00007FFD93B45344
EVP_CIPHER_CTX_free.LIBCRYPTO-3(?,00007FFD93B3F27A), ref: 00007FFD93B4535C
COMP_CTX_free.LIBCRYPTO-3(?,00007FFD93B3F27A), ref: 00007FFD93B4536F
COMP_CTX_free.LIBCRYPTO-3(?,00007FFD93B3F27A), ref: 00007FFD93B45382
EVP_MD_CTX_free.LIBCRYPTO-3(?,00007FFD93B3F27A), ref: 00007FFD93B45395
EVP_MD_CTX_free.LIBCRYPTO-3(?,00007FFD93B3F27A), ref: 00007FFD93B453A8

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: X_free
String ID:
API String ID: 2268491255-0
Opcode ID: 9ebb44a18d46cd6d82ab736cafde8de4ff649955874f619762421e4823475d1b
Instruction ID: eac27cac570ae95e42b025f232e18a9b6a1ad6eb5be0b8906ce8d9242bc6a241
Opcode Fuzzy Hash: 9ebb44a18d46cd6d82ab736cafde8de4ff649955874f619762421e4823475d1b
Instruction Fuzzy Hash: E9014022B08A85C1DB54AFE1D4602A872E8FF90F8CF488136DECD5E6AACE2884518750

Function 00007FFD93B21453 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7A471
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7A47D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7A495

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD93B7A48E
tls_construct_stoc_supported_versions, xrefs: 00007FFD93B7A487

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_construct_stoc_supported_versions
API String ID: 476316267-1917491940
Opcode ID: c659e60a4cb5b7cfb9d646d06c25c46f0c530abaf28ab41a8ad4c29e66aed8cd
Instruction ID: 6786cdc45e6a1cdef83a2e081bf1f59b8601faea25b4216056930ce5d8a5a6b0
Opcode Fuzzy Hash: c659e60a4cb5b7cfb9d646d06c25c46f0c530abaf28ab41a8ad4c29e66aed8cd
Instruction Fuzzy Hash: A521E252B0814342FBB496A5E8797B91358DF907C8F544031DECEA7BE2DE2DE9828701

Function 00007FFD93B39410 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

OPENSSL_strcasecmp.LIBCRYPTO-3 ref: 00007FFD93B39445
OPENSSL_strcasecmp.LIBCRYPTO-3 ref: 00007FFD93B39458

Strings

automatic, xrefs: 00007FFD93B3944E
+automatic, xrefs: 00007FFD93B3943B
auto, xrefs: 00007FFD93B3946A

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: L_strcasecmp
String ID: +automatic$auto$automatic
API String ID: 4194642261-1892669398
Opcode ID: 119b423f726b6808b0a7a4277664e31be03bf93c97af1285d5ef739f9ec5cf63
Instruction ID: 06cdca67c9a67c18e99077be388cc25286ac65f9bd9cdab2d461172abcedaf26
Opcode Fuzzy Hash: 119b423f726b6808b0a7a4277664e31be03bf93c97af1285d5ef739f9ec5cf63
Instruction Fuzzy Hash: 9021B526B0EA6241FB748B95E8203787799AF84B88F485531EECE67786DE2CE4148310

Function 00007FFD93B21794 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D188
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7D19F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7D1B7

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD93B7D1B0
tls_parse_ctos_sig_algs_cert, xrefs: 00007FFD93B7D1A9

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_sig_algs_cert
API String ID: 476316267-1840853530
Opcode ID: 1073be0a9b484ce19d832c05d5a2653f12d436c50a18cc8e4b4aec750ab669b4
Instruction ID: 0fa133291e2fd57992b2891767fb7988beb16cf9d91955acbfeae9a2827c4f3c
Opcode Fuzzy Hash: 1073be0a9b484ce19d832c05d5a2653f12d436c50a18cc8e4b4aec750ab669b4
Instruction Fuzzy Hash: 08219522F1C59686E7749BA4E821BB96398EB5438CF044235EACD66E91DF3CE2D18604

Function 00007FFD93B21B3B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93B853FA
ERR_new.LIBCRYPTO-3 ref: 00007FFD93B85414
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B8542C

Strings

tls_construct_next_proto, xrefs: 00007FFD93B85419
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93B85425

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugmemset
String ID: ..\s\ssl\statem\statem_clnt.c$tls_construct_next_proto
API String ID: 2489314161-3748680027
Opcode ID: a63ed33d5ae16ae017d3757c2c6a9199de8a0d40b97f66390abf19fc98b05f30
Instruction ID: aa8c39c217126c9799b733acdd663d6846599ed6981a7076c0a9ebe5cf1bc11f
Opcode Fuzzy Hash: a63ed33d5ae16ae017d3757c2c6a9199de8a0d40b97f66390abf19fc98b05f30
Instruction Fuzzy Hash: AA11BC26B2868181E760D792F4657EA6264EB94BCCF440431EE8D6BB8ADF3CD541C740

Function 00007FFD93B5D6E6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFD93B5D708
BIO_printf.LIBCRYPTO-3 ref: 00007FFD93B5D744

Strings

%s=0x%x (%s), xrefs: 00007FFD93B5D73D
server_version, xrefs: 00007FFD93B5D733
cookie, xrefs: 00007FFD93B5D773

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s=0x%x (%s)$cookie$server_version
API String ID: 1860387303-2821402668
Opcode ID: cdcd296945ee0c6af791d258c8f2ca5dcabc6c3aa595190e87285eab1cdc08fc
Instruction ID: 09812e8a8cfb4f4249706e09dc26f357fe1f11f8bbd91d830ee2c5d0f349b868
Opcode Fuzzy Hash: cdcd296945ee0c6af791d258c8f2ca5dcabc6c3aa595190e87285eab1cdc08fc
Instruction Fuzzy Hash: E211C462B1D79241E6309BD4E4200B9726AEB907ACF444336D9ED276E5DE3CD582C314

Function 00007FFD93B21B2C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B47163
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B4717B
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B4718C

Strings

ssl_check_srvr_ecc_cert_and_alg, xrefs: 00007FFD93B47168
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B47174

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_check_srvr_ecc_cert_and_alg
API String ID: 1552677711-1191861246
Opcode ID: c41aa21bc8e69c49e68a36b23f3fdc6b30ceacc36a38453507638091020d385f
Instruction ID: 0b7858c7bb3f79f95932bcbb27e7a9c7e9a21bbd964e36eed3823167bd04b2ac
Opcode Fuzzy Hash: c41aa21bc8e69c49e68a36b23f3fdc6b30ceacc36a38453507638091020d385f
Instruction Fuzzy Hash: B4F0A75AF1815242F774A7E4C8763FD1259AF4034CFD04070D58C236D2CE2CA549C704

Function 00007FFD93B2D0EC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B2D0F1
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B2D109
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B2D119

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFD93B2D102
ssl3_ctrl, xrefs: 00007FFD93B2D0F6

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\s3_lib.c$ssl3_ctrl
API String ID: 1552677711-3079590724
Opcode ID: a860d735f6fe460b9ed38740efebbfc35dfccece810951fad2f9c33abfa7f6eb
Instruction ID: a2ac47cc37a5d949d5b5df1e4b534c46e2d88ee0a27b12e71e6cdef782f46e74
Opcode Fuzzy Hash: a860d735f6fe460b9ed38740efebbfc35dfccece810951fad2f9c33abfa7f6eb
Instruction Fuzzy Hash: FEF0E216F0DAA1D1F670EBE4E0301F82318EF5575CF840036CE9D62A869F2CE582D225

Function 00007FFD93B210F5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B296CA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B296E0
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B296F0

Strings

pqueue_new, xrefs: 00007FFD93B296CF
..\s\ssl\pqueue.c, xrefs: 00007FFD93B296B3, 00007FFD93B296D9

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\pqueue.c$pqueue_new
API String ID: 1552677711-2823724430
Opcode ID: 4fec400a62d84a03df9aedca83976200def0fce04fbe909b966fde54edf37fc4
Instruction ID: 8d85acd8a599d319b92e43cb583e1f843914188d8cad6f14d976eaa93e9b4576
Opcode Fuzzy Hash: 4fec400a62d84a03df9aedca83976200def0fce04fbe909b966fde54edf37fc4
Instruction Fuzzy Hash: 26F0E2A6F0910396EB31AFE4C430AF83399EF1470CF940034D99C22692EE2CF645C704

Function 00007FFD93B533F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B53402
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B5341A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B5342B

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFD93B53413
SSL_set_tlsext_max_fragment_length, xrefs: 00007FFD93B53407

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$SSL_set_tlsext_max_fragment_length
API String ID: 1552677711-2316233728
Opcode ID: 9ed479348e7acf0d09b4a017a7bde8f21df55abddd4617647bbf75be60f4deba
Instruction ID: 6087c6ad9f9532f8f01f8f60c7c36620b8e0ae67d10c433221846c6f542177f9
Opcode Fuzzy Hash: 9ed479348e7acf0d09b4a017a7bde8f21df55abddd4617647bbf75be60f4deba
Instruction Fuzzy Hash: DBE0D81AF1D0D147F360F3F4D8767EA1215AF6030CFD04030E08C626D2DE2CA68A8605

Function 00007FFD93B53150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B53162
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B5317A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B5318B

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFD93B53173
SSL_CTX_set_tlsext_max_fragment_length, xrefs: 00007FFD93B53167

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$SSL_CTX_set_tlsext_max_fragment_length
API String ID: 1552677711-1180925554
Opcode ID: a2ccf03ef1e851bf608a7eabc95ac11aa916ea27bfcf4fac2c59953d6929bc0a
Instruction ID: 2cfeeb70c04110f0fa94741022a2a9af11dabc8e381975ccd1d0dd6101e6b8f5
Opcode Fuzzy Hash: a2ccf03ef1e851bf608a7eabc95ac11aa916ea27bfcf4fac2c59953d6929bc0a
Instruction Fuzzy Hash: D7E0921AF1959546F364F3F4D87A7EA1219AF60308FE04431E08C616D2DD2CA64A8A05

Function 00007FFD93B21445 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B3BCBD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B3BCD5
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93B3BCE6

Strings

ssl_undefined_function, xrefs: 00007FFD93B3BCC2
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93B3BCCE

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: eb668bfcb294817dc9ac1ed38ec7e655d6b9154359c3840f46d898fa57ace209
Instruction ID: aaebff359b54ac580b3623a0a9f8bcc6682cfccbee79542838fdfd6d7c7ee95b
Opcode Fuzzy Hash: eb668bfcb294817dc9ac1ed38ec7e655d6b9154359c3840f46d898fa57ace209
Instruction Fuzzy Hash: EFE04F19F1801292F370F7A0D8729FD2268AB5030CFE04031E18C62AD2CE2CA9858744

Function 00007FFD9391EF40 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 390COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD9391EFE6

Strings

vtable constructor failed: %s, xrefs: 00007FFD9391F159
hidden, xrefs: 00007FFD9391F3DD
vtable constructor called recursively: %s, xrefs: 00007FFD9391F112
vtable constructor did not declare schema: %s, xrefs: 00007FFD9391F298

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
API String ID: 3510742995-1299490920
Opcode ID: c7bf2feb45661c88a52c7ebd34633b562d593e1612a42e11022e355098098c4e
Instruction ID: 8f43100595d617b3eeba31ea8afbcd3aff8c862464af17b3a2e2b1b8707a2554
Opcode Fuzzy Hash: c7bf2feb45661c88a52c7ebd34633b562d593e1612a42e11022e355098098c4e
Instruction Fuzzy Hash: 2502D062B08B8992EB718B91E46437A77A9FB8AB94F044231DE5E27795DF3CE441C300

Function 00007FFD938ABFE0 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 366COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938AC12D
memcpy.VCRUNTIME140 ref: 00007FFD938AC287

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938AC0D3, 00007FFD938AC21A
database corruption, xrefs: 00007FFD938AC0E0, 00007FFD938AC227
%s at line %d of [%.10s], xrefs: 00007FFD938AC0EC, 00007FFD938AC233

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: 82882c0c8ae97d424e1c106e57682a3131d3c85fc700fa23b5bc464ad95a1b36
Instruction ID: 1ef36f81bcb7963dc220503d2fb56a07c35dde48292e650a0859bdd532d749e0
Opcode Fuzzy Hash: 82882c0c8ae97d424e1c106e57682a3131d3c85fc700fa23b5bc464ad95a1b36
Instruction Fuzzy Hash: A4F18A76709BC586DBA0CB99E0547AD77A8FB84B94F108036EE8E93795DF3AD844C700

Function 00007FFD938A7950 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD938A7A6A
memset.VCRUNTIME140 ref: 00007FFD938A7BFD

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938A7D9F
database corruption, xrefs: 00007FFD938A7DAC
%s at line %d of [%.10s], xrefs: 00007FFD938A7DB8

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: 5257c2dc97ebf6ac421b159a625c0b08f507e87ed0acef54236e117c6eb1d546
Instruction ID: df09e93152d36cfbfc067bf6500730092787fdcd09418e7ce2d111ef77c1767f
Opcode Fuzzy Hash: 5257c2dc97ebf6ac421b159a625c0b08f507e87ed0acef54236e117c6eb1d546
Instruction Fuzzy Hash: 7FD19E72708AC586DB60CFA5D4246A977A8FB88B88F154036EF4D97794EF3AD842C350

Function 00007FFD93909870 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,?,00000000,00007FFD9390A0B5,?,?,?), ref: 00007FFD939098F0
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00000000,?,?,00000000,00007FFD9390A0B5,?,?,?), ref: 00007FFD93909A37

Strings

%.*z:%u, xrefs: 00007FFD93909B06
rowid, xrefs: 00007FFD939099C8
column%d, xrefs: 00007FFD93909A45

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpymemset
String ID: %.*z:%u$column%d$rowid
API String ID: 1297977491-2903559916
Opcode ID: a0986c3b7fb094be0d0235014583c252c916b00fa30d7d98681540f84d032688
Instruction ID: 9a6d890d3dc95e149750d2799b73512b77b9dcda66c73816468e9b62102e3421
Opcode Fuzzy Hash: a0986c3b7fb094be0d0235014583c252c916b00fa30d7d98681540f84d032688
Instruction Fuzzy Hash: B9B1E22AB0968295FA358B9994603BA67EAEF41B94F484135DE9D277E5DF3CE801C300

Function 00007FFD938CD440 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD938C7857), ref: 00007FFD938CD59A
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD938C7857), ref: 00007FFD938CD5C4
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD938C7857), ref: 00007FFD938CD5E2
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD938C7857), ref: 00007FFD938CD617

Strings

H, xrefs: 00007FFD938CD5AE

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy$memset
String ID: H
API String ID: 438689982-2852464175
Opcode ID: 514d7303eeb31d981147c69c7a56ef58d2f0ef438fa373e1b1835ae557823639
Instruction ID: 61a89d0f4c128f890865391cf379a32ba2bd1a75ed8f3e03e7b0bdad5480037e
Opcode Fuzzy Hash: 514d7303eeb31d981147c69c7a56ef58d2f0ef438fa373e1b1835ae557823639
Instruction Fuzzy Hash: 8691CF6271864182EB34BF59D46077AB7A8FB84B94F048636DFAD17B85CF3EE4448B00

Function 00007FFD938AB050 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD938A9890: memcpy.VCRUNTIME140 ref: 00007FFD938A98FD
Part of subcall function 00007FFD938A9890: memcpy.VCRUNTIME140 ref: 00007FFD938A9924

memcpy.VCRUNTIME140 ref: 00007FFD938AB2D3
memcpy.VCRUNTIME140 ref: 00007FFD938AB2E9

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938AB0F7
database corruption, xrefs: 00007FFD938AB110
%s at line %d of [%.10s], xrefs: 00007FFD938AB117

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 3510742995-3727861699
Opcode ID: f8d757b6f6ddf41b4288a977a15951fa8bc1acdd1edcca7159d9f0a984088662
Instruction ID: b11de6346943c262c3155cf8ee337c5b828aa2ceb69dafddc89006e3542c08d3
Opcode Fuzzy Hash: f8d757b6f6ddf41b4288a977a15951fa8bc1acdd1edcca7159d9f0a984088662
Instruction Fuzzy Hash: BA81EE32B086C28AE7619FA5D4647AE77A9FB84784F008036EB4E97791DF3EE445C740

Function 00007FFD938A8980 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938A8A2C
database corruption, xrefs: 00007FFD938A8A3F
%s at line %d of [%.10s], xrefs: 00007FFD938A8A46

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: 37885e230445e625836c0b98dfbd3fbc658fb3722d570230f9dd813dbea01247
Instruction ID: c759f3e93167fa4ad3ac18c1d0311a43fdcabd7ebca5fab9932444f7fea6006f
Opcode Fuzzy Hash: 37885e230445e625836c0b98dfbd3fbc658fb3722d570230f9dd813dbea01247
Instruction Fuzzy Hash: C8810762B082D19AD7708BA5D1A067E7BE8FB40784F444132DF8DA7691DF3DE856C720

Function 00007FFD9391D7E0 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00000001,00007FFD9391DA8A,?,?,?,00007FFD9391DE4B), ref: 00007FFD9391D949
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000,00000001,00007FFD9391DA8A,?,?,?,00007FFD9391DE4B), ref: 00007FFD9391D963
memcpy.VCRUNTIME140(?,?,?,?,?,?,00000000,00000001,00007FFD9391DA8A,?,?,?,00007FFD9391DE4B), ref: 00007FFD9391D9F7

Strings

CRE, xrefs: 00007FFD9391D93F
INS, xrefs: 00007FFD9391D959

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: strncmp$memcpy
String ID: CRE$INS
API String ID: 2549481713-4116259516
Opcode ID: ad493e8e926393c49f087112ed5859b627cd9242fd5140a57bdb1b6d04aa5b5c
Instruction ID: d617ddc6df83d781d526cc54c49db7a56135299c23e13f4b668478849dfb3b8c
Opcode Fuzzy Hash: ad493e8e926393c49f087112ed5859b627cd9242fd5140a57bdb1b6d04aa5b5c
Instruction Fuzzy Hash: 2751C021B0E642A9FB709BE6946037963A9AF88FC4F584131DE5D7B795DE3DE8028340

Function 00007FFD938A8C80 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938A8D07
memmove.VCRUNTIME140 ref: 00007FFD938A8DE5

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938A8E89
database corruption, xrefs: 00007FFD938A8E95
%s at line %d of [%.10s], xrefs: 00007FFD938A8EA1

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpymemmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 167125708-3727861699
Opcode ID: fa305c5e949a5a68f1c208b0ddc46044faa8d3aadb5c944f47dfcb6f7fb3c792
Instruction ID: 729ed0a6f01eccd074df4f71af7ea2e8d5ff9eb2215ab08b7b1505a66d408b20
Opcode Fuzzy Hash: fa305c5e949a5a68f1c208b0ddc46044faa8d3aadb5c944f47dfcb6f7fb3c792
Instruction Fuzzy Hash: 3251F073708BC0C5CB20CB85E4986AEBB69F754784F95813AEA8E53754DB3DD842C721

Function 00007FFD9388D970 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD9388D9B4
memcpy.VCRUNTIME140 ref: 00007FFD9388D9DD
memset.VCRUNTIME140 ref: 00007FFD9388DAF4

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFD9388DAC9
winRead, xrefs: 00007FFD9388DA88

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy$memset
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 438689982-1843600136
Opcode ID: 2d071f0ec14e9f2342e488c5eceac2ac141867fbcd48d604d31c43613abbfcf6
Instruction ID: 24f83bf0f9d1622c94eaa4eee429978d9d66db0a05bced2396a3d020340bdeb6
Opcode Fuzzy Hash: 2d071f0ec14e9f2342e488c5eceac2ac141867fbcd48d604d31c43613abbfcf6
Instruction Fuzzy Hash: 4F411232B08A0283E730DF99E8946B977A9FB44780F654136EE6D63794DF3DE54A8340

Function 00007FFD93B21FFF Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD93B31818
X509_get_subject_name.LIBCRYPTO-3 ref: 00007FFD93B3182C
X509_NAME_dup.LIBCRYPTO-3 ref: 00007FFD93B31834
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFD93B3184B
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFD93B31857

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: X509_$E_dupE_freeL_sk_new_nullL_sk_pushX509_get_subject_name
String ID:
API String ID: 2231116090-0
Opcode ID: 19a918e9c7487d2fa9c0a98b711aa9985190f3e384999aa2583d9ad76c3931f2
Instruction ID: 51d16e71b370767440faa1713538f84b53612415a7cc0097542b7aece781a055
Opcode Fuzzy Hash: 19a918e9c7487d2fa9c0a98b711aa9985190f3e384999aa2583d9ad76c3931f2
Instruction Fuzzy Hash: 7B014B15F0B64240FEA9A6E6E1657B9519DDF58BCCF080034ED9C5B78AFE2CE8814604

Function 00007FFD93B5B140 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFD93B5B1CE
BIO_printf.LIBCRYPTO-3 ref: 00007FFD93B5B204

Strings

UNKNOWN, xrefs: 00007FFD93B5B1F0
%s (%d), xrefs: 00007FFD93B5B1FA

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s (%d)$UNKNOWN
API String ID: 1860387303-2251275378
Opcode ID: a6b6a6df7af930050c1c9ecaa713cb2278706dcd97de78112f4413c0d46a13d3
Instruction ID: 1950e438ba780038164dd462dec82cde3e7117c20b3bfaaaf6d359047beaedf6
Opcode Fuzzy Hash: a6b6a6df7af930050c1c9ecaa713cb2278706dcd97de78112f4413c0d46a13d3
Instruction Fuzzy Hash: A121D623B1878145E761DBD6F82057AAAD9BB55BD8F484031DECD53B44CE3CD4428700

Function 00007FFD93B21E3D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B73336
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7334E

Strings

tls_construct_ctos_psk_kex_modes, xrefs: 00007FFD93B7333B
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93B73347

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_psk_kex_modes
API String ID: 193678381-3633525602
Opcode ID: 8dbcbfca64766e358cef07fae26e027050f3f98b0906e65b91c24a6594fb192c
Instruction ID: 8c586a0dce950904cf0159161c72004d3ad9a03ec1b5e8b694fe7308b1c6658c
Opcode Fuzzy Hash: 8dbcbfca64766e358cef07fae26e027050f3f98b0906e65b91c24a6594fb192c
Instruction Fuzzy Hash: 0321A721F0C14246FB749B92D5617BD5258EF84788F4D4130DD9EA7AC6DF2CEA418740

Function 00007FFD93B218F7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B99243
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B9925B

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93B99254
tls_post_process_client_key_exchange, xrefs: 00007FFD93B99248

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_post_process_client_key_exchange
API String ID: 193678381-3756838607
Opcode ID: 6115f02e10e10d54511c2d4eff957bde831b920d15455fcbce65d864a4f92994
Instruction ID: ab5203249a3bbff7f3d7d540cc0092feb2741ad327d94da68a2189191efed788
Opcode Fuzzy Hash: 6115f02e10e10d54511c2d4eff957bde831b920d15455fcbce65d864a4f92994
Instruction Fuzzy Hash: B201D422F0810282FBF497E5D4657F932899F5034CF984530D58DAA2E2DE3CE9D1C200

Function 00007FFD93B21370 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

ossl_statem_server_write_transition, xrefs: 00007FFD93B952EC
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93B952F8

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_srvr.c$ossl_statem_server_write_transition
API String ID: 0-415349073
Opcode ID: 6264c82bce936dc4e222d51c453f8f3279ad91e46b03a388bfdd0a29d8ca076a
Instruction ID: 35320d5c46f81094dabd9a3891e9005cf272420680db720346e07b3852acc36e
Opcode Fuzzy Hash: 6264c82bce936dc4e222d51c453f8f3279ad91e46b03a388bfdd0a29d8ca076a
Instruction Fuzzy Hash: EC01F522F0824282E770D794D8B5AFC2369EB8574CF984032DACCA77D1CE6DE981C240

Function 00007FFD93B65330 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B6534B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B65363

Strings

dtls1_write_bytes, xrefs: 00007FFD93B65350
..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFD93B6535C

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\record\rec_layer_d1.c$dtls1_write_bytes
API String ID: 193678381-1372159586
Opcode ID: 92c8e341b9835d8f9078a0bd727e5bf1ccbcaea479ad0cb269e9fc6b3632c01d
Instruction ID: 3a370a2a5631a98d1974eb5ca53669d934cddd9a9d0930a2ce5c17b309c475b1
Opcode Fuzzy Hash: 92c8e341b9835d8f9078a0bd727e5bf1ccbcaea479ad0cb269e9fc6b3632c01d
Instruction Fuzzy Hash: BCF0F0B2F1820182E720ABE0E8217E92368AF9836CF440231EA9C167D2DF3CD290C604

Function 00007FFD93B2155F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B85312
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B8532A

Strings

tls_construct_end_of_early_data, xrefs: 00007FFD93B85317
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93B85323

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_construct_end_of_early_data
API String ID: 193678381-2034458699
Opcode ID: 0948556e184ac68a7c19737e2948511d81886ddc747b700e31176f15218405f2
Instruction ID: e20b83ef7f13d7b92279f5e1f593dedc82dd5fe1b1501ece5805719fb61d0de1
Opcode Fuzzy Hash: 0948556e184ac68a7c19737e2948511d81886ddc747b700e31176f15218405f2
Instruction Fuzzy Hash: DEF0E262F1404283F730EBF4D829BE82698AF5431CF980131EA8CA66D1DE3CE6828700

Function 00007FFD93B21172 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93B7B849
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93B7B861

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD93B7B85A
tls_parse_ctos_ems, xrefs: 00007FFD93B7B84E

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_ems
API String ID: 193678381-2230499117
Opcode ID: 53df696fefbac6b795cc0ce54585cb5dfe01f3e0f5d899642b7c799f82f128c5
Instruction ID: d2ac3504560a5cbd58e863b1a67b50825b5a395506174364213ae6b38b5b726d
Opcode Fuzzy Hash: 53df696fefbac6b795cc0ce54585cb5dfe01f3e0f5d899642b7c799f82f128c5
Instruction Fuzzy Hash: 51F0B462F0928242FB74E7E0D4797E92298DF5034CF540030D58D636D2DF2C69D68700

Function 00007FFD9389F5E0 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD9389BB20: RaiseException.KERNEL32 ref: 00007FFD9389BB75

memcmp.VCRUNTIME140 ref: 00007FFD9389F636

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD9389F7F3
database corruption, xrefs: 00007FFD9389F800
%s at line %d of [%.10s], xrefs: 00007FFD9389F80C

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: ExceptionRaisememcmp
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2159421160-3727861699
Opcode ID: e8b616cbf673acef5e01a3a176977a3c286c3d4abfa38d4e2761df08d4ae37fa
Instruction ID: 1598fc65ada1d1e55307980b9e315ce2a61ca5baab42751526e9b375538f43e7
Opcode Fuzzy Hash: e8b616cbf673acef5e01a3a176977a3c286c3d4abfa38d4e2761df08d4ae37fa
Instruction Fuzzy Hash: 86F17E32B04B429BE768CBA5C5606BD3BA9FB44B89F104035DF0DA7B95DF39E8258740

Function 00007FFD938E41C0 Relevance: 6.3, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD938E4220
memcpy.VCRUNTIME140 ref: 00007FFD938E4235
memcpy.VCRUNTIME140 ref: 00007FFD938E4259
memcpy.VCRUNTIME140 ref: 00007FFD938E4278
memcpy.VCRUNTIME140 ref: 00007FFD938E4290

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 65c167b629d3beafb1ba237e326e94310d99c22fee7a7913818827570b6759f6
Instruction ID: 4de8687d6a845742013de0ebcc113b3ba079eb65ae54423d2143a26934b722b3
Opcode Fuzzy Hash: 65c167b629d3beafb1ba237e326e94310d99c22fee7a7913818827570b6759f6
Instruction Fuzzy Hash: 8C218DA6B1874283D674AFA6B5612BAA3A5FB44BC0B085031EF8E57F56CF2DE0518300

Function 00007FFD9388EBD0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD9388EC5C

Strings

%s-shm, xrefs: 00007FFD9388EC73
winOpenShm, xrefs: 00007FFD9388EE6A
readonly_shm, xrefs: 00007FFD9388EDFA

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memset
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 2221118986-2815843928
Opcode ID: 2a5a57302c95da27438afc0f0be742ebfee7cb1e02ee35a170ee694a6a849572
Instruction ID: 5a5d5dfd1895c087db7bb0e4666c33b3b96f4b495514c02adffea15246468ca4
Opcode Fuzzy Hash: 2a5a57302c95da27438afc0f0be742ebfee7cb1e02ee35a170ee694a6a849572
Instruction Fuzzy Hash: 16C15921B0DA4293FA749BE1B86477933A8FF44B84F044635DA6E66BA0DF3DF9448300

Function 00007FFD939186F0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFD93918BBF), ref: 00007FFD93918889
memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFD93918BBF), ref: 00007FFD9391890B
memcpy.VCRUNTIME140(?,?,?,?,00000080,?,?,?,00000000,00007FFD93918BBF), ref: 00007FFD939189FD

Strings

RETURNING may not use "TABLE.*" wildcards, xrefs: 00007FFD93918771

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: RETURNING may not use "TABLE.*" wildcards
API String ID: 3510742995-2313493979
Opcode ID: 7e7e19360dff169692bdddae953b084c6e9b73729217d5cafa84439cbde45142
Instruction ID: 201cc0a9037fed0593d6e107614ba941c3f89d9d50941f230411bbb78e039fa9
Opcode Fuzzy Hash: 7e7e19360dff169692bdddae953b084c6e9b73729217d5cafa84439cbde45142
Instruction Fuzzy Hash: 4BB19E22B0CB8196E720CF9594503A977A5FB89BA4F098335DEAD277D5DF38E591C300

Function 00007FFD93920590 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 216COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD939206FF

Part of subcall function 00007FFD93888BE0: memcpy.VCRUNTIME140(?,?,?,00007FFD938885F6), ref: 00007FFD93888C11

Strings

AND , xrefs: 00007FFD939205CF, 00007FFD939205EA
<expr>, xrefs: 00007FFD93920693
rowid, xrefs: 00007FFD939206CE

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: AND $<expr>$rowid
API String ID: 3510742995-4041574714
Opcode ID: dd646301f3f38bd4a60472295e9e9de02cdab538944d7568d1223df78a7563ce
Instruction ID: edda6a815e6ef934d72cf5b4e49b4096aace4dbaa55fcbc93f049bdf2c8a752b
Opcode Fuzzy Hash: dd646301f3f38bd4a60472295e9e9de02cdab538944d7568d1223df78a7563ce
Instruction Fuzzy Hash: 94A1E272B08A42DAE724DF59D4A063877A9FB54B84F444135DE1E27394CF3DE881CB80

Function 00007FFD93909510 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

%s.%s, xrefs: 00007FFD9390968E
rowid, xrefs: 00007FFD9390966E
column%d, xrefs: 00007FFD93909718

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID:
String ID: %s.%s$column%d$rowid
API String ID: 0-1505470444
Opcode ID: 33050f6a5ce778ce640403e38a7c40036c7d6c6581dc2e086520fb0cdce24bb2
Instruction ID: 6bda12201c26d1f447916067f57da05cf498bfdf79b91f358d6bd16e13e739b4
Opcode Fuzzy Hash: 33050f6a5ce778ce640403e38a7c40036c7d6c6581dc2e086520fb0cdce24bb2
Instruction Fuzzy Hash: 7C91AB26B08B8191EA20DB99D4643A967A9FB49BB4F044336DEBC673E0DF3DD441C300

Function 00007FFD938E3F30 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938E415E

Strings

, xrefs: 00007FFD938E400D
CREATE TABLE , xrefs: 00007FFD938E404F
, , xrefs: 00007FFD938E3FEE

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: $, $CREATE TABLE
API String ID: 3510742995-3459038510
Opcode ID: 197c06f336dd481d99a17018bb7484b9d0b710a484bbfa3c9a573c34cc9d67ed
Instruction ID: 4dc4773d85669fa25678c1cec8d4909f0bdbee502bd1474d51499364bd2ebab7
Opcode Fuzzy Hash: 197c06f336dd481d99a17018bb7484b9d0b710a484bbfa3c9a573c34cc9d67ed
Instruction Fuzzy Hash: F6616D62B0868296DB359F69E4502BAB7A6FB40BA4F444335DE6D533D1DF3ED846C300

Function 00007FFD9389A080 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 174COMMON

Download Yara Rule

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD9389A0A2, 00007FFD9389A1F8
database corruption, xrefs: 00007FFD9389A0BB, 00007FFD9389A211
%s at line %d of [%.10s], xrefs: 00007FFD9389A0C2, 00007FFD9389A218

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: d6573954900b16364444043268c9b023c5c345b93ada139dabdaeda47b1bcc02
Instruction ID: 5198c44c373d92ec74a93fc4c8619319fcf251d924d96c7c129e4352c0124f60
Opcode Fuzzy Hash: d6573954900b16364444043268c9b023c5c345b93ada139dabdaeda47b1bcc02
Instruction Fuzzy Hash: F4719125B0864292FB759BE5E4603797BB9FB84B84F144031CE4E6B7A5DF3EE8918301

Function 00007FFD938BC607 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938BC74D
memcpy.VCRUNTIME140 ref: 00007FFD938BC766

Strings

string or blob too big, xrefs: 00007FFD938C2123
out of memory, xrefs: 00007FFD938C2498

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: out of memory$string or blob too big
API String ID: 3510742995-2410398255
Opcode ID: 2546402ceff79975b6071e291ca9160533ac407746b903c1a5e86b998dc6c08d
Instruction ID: a176f86f456ebee6974ab58faf5233e81d15358ada2ae6eec13027c8a41aecc0
Opcode Fuzzy Hash: 2546402ceff79975b6071e291ca9160533ac407746b903c1a5e86b998dc6c08d
Instruction Fuzzy Hash: 3861D1A6B0869382EB24DB66D16027E6778FF45B94F100036EF4D27B95CF3EE4528750

Function 00007FFD9389A310 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD9389A438

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD9389A4F2
database corruption, xrefs: 00007FFD9389A4FF
%s at line %d of [%.10s], xrefs: 00007FFD9389A50B

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: 965b7ab3460d33b6041eb80250217ce8e540c24e52087ecc8f989d76abead06f
Instruction ID: 019f26f1d8f3c219d33487748f8e4999dcf63aa185382a3af16ff9b7aebe8691
Opcode Fuzzy Hash: 965b7ab3460d33b6041eb80250217ce8e540c24e52087ecc8f989d76abead06f
Instruction Fuzzy Hash: 5651CE26708B41A6EB64CBA5E5647AE7BA8FB88B88F144032DF4D63754DF3EE550C301

Function 00007FFD93888407 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938884B8
memcpy.VCRUNTIME140 ref: 00007FFD9388853E

Strings

(join-%u), xrefs: 00007FFD93888549
(subquery-%u), xrefs: 00007FFD93888560

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: (join-%u)$(subquery-%u)
API String ID: 3510742995-2916047017
Opcode ID: dd03e86373ea881490972c419df84515b5e456637643e20537e58924f789cd37
Instruction ID: edc0be9514539406684b708a1c7b2167342445c9efeab04bfc6b7ab8f6701bd5
Opcode Fuzzy Hash: dd03e86373ea881490972c419df84515b5e456637643e20537e58924f789cd37
Instruction Fuzzy Hash: 2451CD72B1924287EB70CBA5D0A4B3927A9FB50BA4F564631CE3D572C5CF3EE8428740

Function 00007FFD938A8ED0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFD938A8FF2

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938A9058
database corruption, xrefs: 00007FFD938A9065
%s at line %d of [%.10s], xrefs: 00007FFD938A9071

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2162964266-3727861699
Opcode ID: b41f21bbc434ec6d1de5086e02495e52cde0cfce1eb061fb3c9577bcc6dba8bb
Instruction ID: c4df9d175e9a42a9e91d3d8541450bc66776755f137986d8dc70e4ba212fd977
Opcode Fuzzy Hash: b41f21bbc434ec6d1de5086e02495e52cde0cfce1eb061fb3c9577bcc6dba8bb
Instruction Fuzzy Hash: 0A518D32708BC5D6EB20CF55E4102AAB7AAFB84B84F944036DA8DA3B58CF3DD556C710

Function 00007FFD938AFE50 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938AFF83

Strings

%!.15g, xrefs: 00007FFD938AFFCC
, xrefs: 00007FFD938AFFA2
-, xrefs: 00007FFD938AFF67

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID: $%!.15g$-
API String ID: 3510742995-875264902
Opcode ID: ffdc6392e0312284d0d157c5cf372c93c08476705884f8b4537a0fac0e79bd20
Instruction ID: c72f48e2144a26171109dc64f815811119d3794e41fd332361c454c18275b0bc
Opcode Fuzzy Hash: ffdc6392e0312284d0d157c5cf372c93c08476705884f8b4537a0fac0e79bd20
Instruction Fuzzy Hash: 4F413462B1C7C587EB20CB6EE4607BA7BA4EB46780F004135EA8E57B86CB3DD505C710

Function 00007FFD938A8530 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD938A8587
database corruption, xrefs: 00007FFD938A8594
%s at line %d of [%.10s], xrefs: 00007FFD938A85A0

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 0-3727861699
Opcode ID: a07785a57d89a6b6b2cd6742ff57c5158af552e3cd36b9dced591b1559e342f0
Instruction ID: 85803d21d78aa4ff4cdf7be8d46afd0cdbe6d6f8c293a2da9a956ae3e8dfaa82
Opcode Fuzzy Hash: a07785a57d89a6b6b2cd6742ff57c5158af552e3cd36b9dced591b1559e342f0
Instruction Fuzzy Hash: 1931CC72A096C18ED314CFAAD06007D7FA5E745B44F04413ADF899B359EB3CD956CB60

Function 00007FFD9389C1F0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD9389C257

Strings

8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355, xrefs: 00007FFD9389C2F2
database corruption, xrefs: 00007FFD9389C2FF
%s at line %d of [%.10s], xrefs: 00007FFD9389C30B

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$8653b758870e6ef0c98d46b3ace27849054af85da891eb121e9aaa537f1e8355$database corruption
API String ID: 2221118986-3727861699
Opcode ID: 5e863916525a9204ac9d6aa5207d54266211b4af8f85feab029ec6656853ced4
Instruction ID: 9d0471283b592bed250b266700e9e2efb2c57bfce7a59774786be58615b781f5
Opcode Fuzzy Hash: 5e863916525a9204ac9d6aa5207d54266211b4af8f85feab029ec6656853ced4
Instruction Fuzzy Hash: B731A73671868182E7609FE9E4607BA77A9FB88B80F440135FE4E57BA4DF3DD5018B40

Function 00007FFD93B21EB0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FFD93B632AF
BN_bin2bn.LIBCRYPTO-3 ref: 00007FFD93B632C4
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD93B632DA
SRP_Calc_B_ex.LIBCRYPTO-3 ref: 00007FFD93B63316

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: B_exCalc_D_priv_bytes_exL_cleanseN_bin2bn
String ID:
API String ID: 1900010111-0
Opcode ID: 03fecc6caf441c106cbde61d67a99ab36ada639ee13255462899e6d38abb98e3
Instruction ID: 6f106352a2236dca0810e5245bcbca919ac0e45eebb3ec639c593a8e2086423a
Opcode Fuzzy Hash: 03fecc6caf441c106cbde61d67a99ab36ada639ee13255462899e6d38abb98e3
Instruction Fuzzy Hash: 6C31AF22719A8681FBA0CF65D4607AD33A4FB88B9CF184032DE8D5B7A6DF38D551C700

Function 00007FFD93B21005 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

X509_get_subject_name.LIBCRYPTO-3 ref: 00007FFD93B316BC
X509_NAME_dup.LIBCRYPTO-3 ref: 00007FFD93B316C4
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFD93B316DB
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFD93B316E7

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: X509_$E_dupE_freeL_sk_pushX509_get_subject_name
String ID:
API String ID: 417592659-0
Opcode ID: 5f3dc8ab2927161b1bf259cb02d99088dd0ba66715ef283440947a2e7682c744
Instruction ID: 430d0cb7cd5cd1a92b686c2ade49d70ea1f72cdea4a4f9f57b0a0e962c4a8842
Opcode Fuzzy Hash: 5f3dc8ab2927161b1bf259cb02d99088dd0ba66715ef283440947a2e7682c744
Instruction Fuzzy Hash: E4016D65F4B64240FEA8E6EAE2753B9519C9F58BDCF0C4030ED8C5B78AED2CE8904610

Function 00007FFD939B31D0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD939B31FC
GetCurrentThreadId.KERNEL32 ref: 00007FFD939B320A
GetCurrentProcessId.KERNEL32 ref: 00007FFD939B3216
QueryPerformanceCounter.KERNEL32 ref: 00007FFD939B3226

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: cae572169cced5dd2f19bce54058c80e5087122ed076c55999fdcdab2a4b6806
Instruction ID: cd3587fa372d04cfc23aa04a5fc2e9a66a9131d3bd83edf10cce1291ac63ffda
Opcode Fuzzy Hash: cae572169cced5dd2f19bce54058c80e5087122ed076c55999fdcdab2a4b6806
Instruction Fuzzy Hash: 65113C26B15F019AEB20CFA0E8643B933B8FB19B59F440E31DA6D567A4DF7CD2948340

Function 00007FFD93B39210 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

OPENSSL_sk_dup.LIBCRYPTO-3(00000000,00007FFD93B38573), ref: 00007FFD93B39229
OPENSSL_sk_free.LIBCRYPTO-3(00000000,00007FFD93B38573), ref: 00007FFD93B39244
OPENSSL_sk_set_cmp_func.LIBCRYPTO-3(00000000,00007FFD93B38573), ref: 00007FFD93B39256
OPENSSL_sk_sort.LIBCRYPTO-3(00000000,00007FFD93B38573), ref: 00007FFD93B3925E

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: L_sk_dupL_sk_freeL_sk_set_cmp_funcL_sk_sort
String ID:
API String ID: 1312970346-0
Opcode ID: 12e6d4d1afd1d1277fa0f79b28d99069ba464e4763cb726048a7bb04a3b838b0
Instruction ID: 1b9c181a94e4c04e0d264b2561a47980e67a1ea6fe513198846055349b32f598
Opcode Fuzzy Hash: 12e6d4d1afd1d1277fa0f79b28d99069ba464e4763cb726048a7bb04a3b838b0
Instruction Fuzzy Hash: C0F08226F0864181EF65ABA6F5A23B862999F98BCCF444031FE8D57797DD2CD8404200

Function 00007FFD93B475B0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD93B22063: ENGINE_finish.LIBCRYPTO-3 ref: 00007FFD93B61672

ERR_set_mark.LIBCRYPTO-3 ref: 00007FFD93B475DC
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FFD93B475E3
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FFD93B475F1
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFD93B475F9

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: D_fetchE_finishJ_nid2snR_pop_to_markR_set_mark
String ID:
API String ID: 1050435054-0
Opcode ID: 7127929cde7b4689b6cc282457a4f0a2dc6caeda5a604b8849c4ed66afc48e3b
Instruction ID: a56c9cc6946d06bfcbfb0859ce5ef57f1fc173d903dfcabb18bf7612b4b90b39
Opcode Fuzzy Hash: 7127929cde7b4689b6cc282457a4f0a2dc6caeda5a604b8849c4ed66afc48e3b
Instruction Fuzzy Hash: F7F0A001B0838141FAA4ABA7E8611BD91499F99BCCF085038FE9D67B97DD2CE9014600

Function 00007FFD93B47220 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B47244
EVP_CIPHER_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B4725C
COMP_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B4726F
COMP_CTX_free.LIBCRYPTO-3 ref: 00007FFD93B47282

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: X_free
String ID:
API String ID: 2268491255-0
Opcode ID: 363515c756ca6ebd85c3aec3c2b185af4ebda8eba70b28f4b052b87baa8bd7c7
Instruction ID: 2cb936dda30e5d34def2ed48d026d74b9ea127da7ff475d9d1e6ddea8e6f14b0
Opcode Fuzzy Hash: 363515c756ca6ebd85c3aec3c2b185af4ebda8eba70b28f4b052b87baa8bd7c7
Instruction Fuzzy Hash: 34F04F22B0968581EB54AFE6D4612B872E8FF90B8CF088131EECC1A69ACE28C4118750

Function 00007FFD93B816B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

-, xrefs: 00007FFD93B816D4

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 18d029d458eabf41ac2aecac09e559e94495be11c20fdf6dead91fd8276cdb86
Instruction ID: 4fc2b4344fe4dc9722759d43c1d86577ebed4a86f9e7d13076e93be83f54617e
Opcode Fuzzy Hash: 18d029d458eabf41ac2aecac09e559e94495be11c20fdf6dead91fd8276cdb86
Instruction Fuzzy Hash: 67113372F1914187FBA09F9AE1643AC2399EB48B9CF480135DA9D5B386DB3CD495CB04

Function 00007FFD93B81677 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFD93B8162C
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFD93B81639

Strings

', xrefs: 00007FFD93B81680

Memory Dump Source

Source File: 00000002.00000002.3456138650.00007FFD93B21000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFD93B20000, based on PE: true

Associated: 00000002.00000002.3456090418.00007FFD93B20000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456138650.00007FFD93BA2000.00000020.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456310493.00007FFD93BA4000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456393179.00007FFD93BCC000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BD7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3456467550.00007FFD93BDF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93b20000_FluxusV2.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: '
API String ID: 3946675294-1997036262
Opcode ID: b62216ac9af7fa7a938d27819fd2c62991d406f72beb77c406fed53e70659c17
Instruction ID: b37b1b4da19ff4d97a828a119a6731163e091188a80f3c00f15409d6c76466b1
Opcode Fuzzy Hash: b62216ac9af7fa7a938d27819fd2c62991d406f72beb77c406fed53e70659c17
Instruction Fuzzy Hash: A6F09022B0924187FBA0DFA6E0A13BC2395EB88B8CF184034DA9D5B7C6DE3CD4858704

Function 00007FFD93885B75 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFD93885B88
_msize.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFD93885B99

Strings

failed memory resize %u to %u bytes, xrefs: 00007FFD93885BA2

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: _msizerealloc
String ID: failed memory resize %u to %u bytes
API String ID: 2713192863-2134078882
Opcode ID: 75b8f79c93e6a993e734f7f3b378ef07c00aa82b64f7ca0c6d8950d914df2de2
Instruction ID: 975032df8aed9946bed38a33b914e432468068ebbcb247b838b3261d73639f21
Opcode Fuzzy Hash: 75b8f79c93e6a993e734f7f3b378ef07c00aa82b64f7ca0c6d8950d914df2de2
Instruction Fuzzy Hash: C1E09250B0E78182EA644787B9602795365AF4CFC0F445034EE5E2BB59EF2CE4428300

Function 00007FFD938CDB80 Relevance: 5.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD938CDC67
memcpy.VCRUNTIME140 ref: 00007FFD938CDCBB
memcpy.VCRUNTIME140 ref: 00007FFD938CDD17
memcpy.VCRUNTIME140 ref: 00007FFD938CDD97

Memory Dump Source

Source File: 00000002.00000002.3455313592.00007FFD93881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFD93880000, based on PE: true

Associated: 00000002.00000002.3455294099.00007FFD93880000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455411895.00007FFD939B5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455444091.00007FFD939E4000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.3455478397.00007FFD939E9000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93880000_FluxusV2.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 0f453df6e1cdd23ca4e5983e4c2c4cfeba04ca82ce74fc5dc41d7678ab95377b
Instruction ID: 0de75a9319816eb335ccab5c0a030344c6a98a57eb7246e9723f27f6630f4ed8
Opcode Fuzzy Hash: 0f453df6e1cdd23ca4e5983e4c2c4cfeba04ca82ce74fc5dc41d7678ab95377b
Instruction Fuzzy Hash: F691C072B0978686EB74BF5A91602796798FB44BA0F095236EF6D27BC1DF3DE4108700

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FluxusV2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_ARC4.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_chacha20.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_pkcs1_decode.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_aes.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_aesni.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_arc2.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_blowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cast.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cbc.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cfb.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ctr.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_des.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_des3.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ecb.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_eksblowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ocb.pyd

C:\Users\user\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ofb.pyd

Windows Analysis Report
FluxusV2.exe